From 6930cbca0d3a25c72ff3389e6a17298688b8aad8 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sun, 22 Feb 2026 21:46:07 +0100 Subject: [PATCH] package/c-ares: security bump to v1.34.6 For more information about the release, see: - https://github.com/c-ares/c-ares/releases/tag/v1.34.6 Fixes the following vulnerability: - CVE-2025-62408: c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-62408 - https://github.com/c-ares/c-ares/commit/714bf5675c541bd1e668a8db8e67ce012651e618 Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain (cherry picked from commit bed675a240de6643792edd879cbe187b2ee6e0f5) Signed-off-by: Thomas Perale --- package/c-ares/c-ares.hash | 2 +- package/c-ares/c-ares.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/c-ares/c-ares.hash b/package/c-ares/c-ares.hash index 1c28d91e97..7bf4163e55 100644 --- a/package/c-ares/c-ares.hash +++ b/package/c-ares/c-ares.hash @@ -1,5 +1,5 @@ # Locally calculated after checking pgp signature -sha256 7d935790e9af081c25c495fd13c2cfcda4792983418e96358ef6e7320ee06346 c-ares-1.34.5.tar.gz +sha256 912dd7cc3b3e8a79c52fd7fb9c0f4ecf0aaa73e45efda880266a2d6e26b84ef5 c-ares-1.34.6.tar.gz # Hash for license file sha256 460f5e768fda3752ca2169a95df062578a10fb126bfd65f3b9b1a1bed2f84807 LICENSE.md diff --git a/package/c-ares/c-ares.mk b/package/c-ares/c-ares.mk index 090147d0e9..1653b16c28 100644 --- a/package/c-ares/c-ares.mk +++ b/package/c-ares/c-ares.mk @@ -4,7 +4,7 @@ # ################################################################################ -C_ARES_VERSION = 1.34.5 +C_ARES_VERSION = 1.34.6 C_ARES_SITE = https://github.com/c-ares/c-ares/releases/download/v$(C_ARES_VERSION) C_ARES_INSTALL_STAGING = YES C_ARES_CONF_OPTS = --with-random=/dev/urandom