CVE-2023-32067

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

• CWE-400

• https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1Release Notes
• https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vcThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/06/msg00034.htmlMailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202310-09Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240605-0004/
• https://www.debian.org/security/2023/dsa-5419Third Party Advisory
• https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1Release Notes
• https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vcThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/06/msg00034.htmlMailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202310-09Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240605-0004/
• https://www.debian.org/security/2023/dsa-5419Third Party Advisory

Published

May 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32061Discourse is an open source discussion platform. Prior to ve…5.3
• CVE-2023-32062OroPlatform is a package that assists system and user calend…4.3
• CVE-2023-32063OroCalendarBundle enables a Calendar feature and related fun…5
• CVE-2023-32064OroCommerce package with customer portal and non authenticat…4.3
• CVE-2023-32065OroCommerce is an open-source Business to Business Commerce …5.8
• CVE-2023-32066Time Tracker is an open source time tracking system. The wee…5.4
• CVE-2023-32068XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-32069XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2023-3207Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-32070XWiki Platform is a generic wiki platform. Prior to version …6.1
• CVE-2023-32071XWiki Platform is a generic wiki platform. Starting in versi…9
• CVE-2023-32072Tuleap is an open source tool for end to end traceability of…4.8