How severe is CVE-2020-14354?

CVE-2020-14354 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2020-14354 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-14354?

CVE-2020-14354 primarily affects C-ares. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-14354?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-14354 published?

CVE-2020-14354 was published on 2021-05-13 and last updated on 2026-06-17.

CVE-2020-14354

CVE-2020-14354 is a low-severity vulnerability in C-ares with a CVSS 3.x base score of 3.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-415.

Key facts

Severity: Low (CVSS 3.x base score 3.3)
CVSS v2: 2.1
EPSS exploit prediction: 1% (41st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-415
Affected product: C-ares
Published: 2021-05-13
Last modified: 2026-06-17

Description

A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.

Frequently asked questions

What is CVE-2020-14354?: A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
How severe is CVE-2020-14354?: CVE-2020-14354 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2020-14354 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-14354?: CVE-2020-14354 primarily affects C-ares. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-14354?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-14354 published?: CVE-2020-14354 was published on 2021-05-13 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:c-ares:c-ares:1.16.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

More vulnerabilities in C-ares

CVE-2016-5180 — Critical (CVSS 9.8): Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to…
CVE-2017-1000381 — High (CVSS 7.5): The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read…
CVE-2025-62408 — Medium (CVSS 5.9): c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts…
CVE-2020-22217 — Medium (CVSS 5.9): Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in…
CVE-2024-25629 — Medium (CVSS 4.4): c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files…

All CVEs affecting C-ares →

Other CWE-415 (Double Free) vulnerabilities

CVE-2018-0101 — Critical (CVSS 10.0): A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA)…
CVE-2026-8925 — Critical (CVSS 9.8): The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing…
CVE-2020-37239 — Critical (CVSS 9.8): libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety…
CVE-2026-43011 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When…
CVE-2026-31609 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in…
CVE-2026-31608 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: smb: server: avoid double-free in…

Browse all CWE-415 (Double Free) vulnerabilities →