c-ares uses an asynchronous DNS resolver suffered a CPU‑exhaustion flaw that allowed a malicious server to send a response with a long chain of compressed DNS pointers and many records referencing that chain. The resolver would repeatedly decompress the name in a quadratic manner, saturating the single‑threaded event loop and effectively blocking DNS resolution without causing memory corruption or data leaks. The weakness corresponds to uncontrolled consumption of a computer resource.

The flaw occurs in any software that incorporates the c‑ares library in a version prior to 1.34.7. Any system that relies on c‑ares for DNS resolution—such as networked services, DNS clients, or embedded devices—would be vulnerable if it has not applied the v1.34.7 release.

The CVSS score of 7.5 reflects the medium‑to‑high severity of this denial‑of‑service issue. While the EPSS score is not provided, the lack of a public KEV listing suggests no widespread exploitation has been reported yet, but the attack would be carried out by a rogue DNS server that sends a specially crafted response over the network. Once exploited, the targeted application would experience prolonged DNS query failures until the event loop recovers.