{"action":"Upgrade c-ares to 1.18.1-3 or later.","affected":[{"fixed":"1.18.1-3","introduced":"0"}],"component":"c-ares","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1.18.1-3"],"id":"tcs_01M5NJ1QCGCCJKX2WD4WSXC5FV","modified_at":"2026-10-23T18:04:52.801162338Z","published_at":"2023-05-25T22:15:09.760Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2023-31130","https://security-tracker.debian.org/tracker/CVE-2023-31130"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2023-31130#Debian:13/c-ares","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2023-31130"}],"summary":"c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular \"0::00:00:00/2\" was found to cause an issue. C-ares only"}