c-ares uses an asynchronous DNS resolver suffered a CPU‑exhaustion flaw that allowed a malicious server to send a response with a long chain of compressed DNS pointers and many records referencing that chain. The resolver would repeatedly decompress the name in a quadratic manner, saturating the single‑threaded event loop and effectively blocking DNS resolution without causing memory corruption or data leaks. The weakness corresponds to uncontrolled consumption of a computer resource.

The flaw occurs in any software that incorporates the c‑ares library in a version prior to 1.34.7. Any system that relies on c‑ares for DNS resolution—such as networked services, DNS clients, or embedded devices—would be vulnerable if it has not applied the v1.34.7 release.

The CVSS score of 7.5 reflects the medium‑to‑high severity of this denial‑of‑service issue. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a rogue DNS server that sends a specially crafted response over the network. Once exploited, the targeted application would experience prolonged DNS query failures until the event loop recovers.