CVE-2025-62408 is a use-after-free vulnerability in the c-ares asynchronous DNS resolver library, affecting Red Hat Hardened Images. The flaw occurs when a DNS query terminates after maximum attempts, causing the read_answer() and process_answer() functions to trigger a Denial of Service by crashing the process. This vulnerability is tracked as CWE-416. Red Hat classifies the severity as moderate with a CVSS v3 base score of 5.9, primarily due to high impact on availability. No patch or effective mitigation currently meets Red Hat's standards for deployment and stability. The advisory references a GitHub commit addressing the issue upstream but does not confirm a vendor patch. The vulnerability affects asynchronous DNS resolution in applications using c-ares, potentially causing service disruption.

The vulnerability causes a Denial of Service by crashing processes that use the c-ares library for asynchronous DNS resolution when queries terminate after maximum retry attempts. This can disrupt applications relying on c-ares, impacting availability. There is no reported impact on confidentiality or integrity. No known exploits are in the wild. The flaw is due to use-after-free conditions that may corrupt memory leading to process crashes.

Currently, no mitigation is available or meets Red Hat's criteria for ease of use, applicability, and stability. Users should monitor Red Hat advisories for updates on patches or mitigations. Upgrading to a fixed version when available is recommended. Customers with Red Hat Technical Account Managers can seek direct guidance. No immediate workaround is provided by Red Hat.