{"action":"Upgrade c-ares to 1.16.1-1 or later.","affected":[{"fixed":"1.16.1-1","introduced":"0"}],"component":"c-ares","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["1.16.1-1"],"id":"tcs_01M5NEKZEE1V9Y0JG22BFDACZ2","modified_at":"2026-10-26T12:00:36.737553244Z","published_at":"2021-05-13T14:15:17.503Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2020-14354","https://security-tracker.debian.org/tracker/CVE-2020-14354"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2020-14354","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2020-14354"}],"summary":"A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service th"}