CVE-2022-4904

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

• CWE-20
• CWE-1284

• https://bugzilla.redhat.com/show_bug.cgi?id=2168631Issue Tracking, Third Party Advisory
• https://github.com/c-ares/c-ares/issues/496Exploit, Issue Tracking
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33LDNS6RPOPP36Z4MPWXALUQZXJCWJS2/
• https://security.gentoo.org/glsa/202401-02
• https://bugzilla.redhat.com/show_bug.cgi?id=2168631Issue Tracking, Third Party Advisory
• https://github.com/c-ares/c-ares/issues/496Exploit, Issue Tracking
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33LDNS6RPOPP36Z4MPWXALUQZXJCWJS2/
• https://security.gentoo.org/glsa/202401-02

Published

Mar 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-49034In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49035In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49036An inclusion of functionality from untrusted control sphere …7.8
• CVE-2022-49037Insertion of sensitive information into log file vulnerabili…6.5
• CVE-2022-49038Inclusion of functionality from untrusted control sphere vul…7.8
• CVE-2022-49039Out-of-bounds write vulnerability in backup task management …6.7
• CVE-2022-49040Buffer copy without checking size of input ('Classic Buffer …4.4
• CVE-2022-49041Buffer copy without checking size of input ('Classic Buffer …4.4
• CVE-2022-49042An inclusion of functionality from untrusted control sphere …7.8
• CVE-2022-49043xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 ha…7.8
• CVE-2022-49044In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-49045Rejected reason: This CVE ID has been rejected or withdrawn …