How severe is CVE-2020-14354?

CVE-2020-14354 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2020-14354 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-14354?

CVE-2020-14354 primarily affects C-ares. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-14354?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-14354 published?

CVE-2020-14354 was published on 2021-05-13 and last updated on 2026-06-17.

CVE-2020-14354

CVE-2020-14354 is a low-severity vulnerability in C-ares with a CVSS 3.x base score of 3.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-415.

Key facts

Severity: Low (CVSS 3.x base score 3.3)
CVSS v2: 2.1
EPSS exploit prediction: 1% (43rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-415
Affected product: C-ares
Published: 2021-05-13
Last modified: 2026-06-17

Description

A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.

Frequently asked questions

What is CVE-2020-14354?: A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
How severe is CVE-2020-14354?: CVE-2020-14354 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2020-14354 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-14354?: CVE-2020-14354 primarily affects C-ares. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-14354?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-14354 published?: CVE-2020-14354 was published on 2021-05-13 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:c-ares:c-ares:1.16.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

More vulnerabilities in C-ares

CVE-2016-5180 — Critical (CVSS 9.8): Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to…
CVE-2017-1000381 — High (CVSS 7.5): The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read…
CVE-2025-62408 — Medium (CVSS 5.9): c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts…
CVE-2020-22217 — Medium (CVSS 5.9): Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in…
CVE-2024-25629 — Medium (CVSS 4.4): c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files…

All CVEs affecting C-ares →

Other CWE-415 (Double Free) vulnerabilities

CVE-2018-0101 — Critical (CVSS 10.0): A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA)…
CVE-2026-89078 — Critical (CVSS 9.9): GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and…
CVE-2026-84561 — Critical (CVSS 9.8): A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS…
CVE-2026-77493 — Critical (CVSS 9.8): Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
CVE-2026-64387 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay…
CVE-2026-64386 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay…

Browse all CWE-415 (Double Free) vulnerabilities →