CVE catalog

CVE-2025-48945

pycares: CVE-2025-48945

Severity: Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Published: Jun 16, 2025, 4:09:47 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.48% · Oct 25, 2026

pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asynchronously. Prior to version 4.9.0, pycares is vulnerable to a use-after-free condition that occurs when a Channel object is garbage collected while DNS queries are still pending. This results in a fatal Python error and interpreter crash. The vulnerability has been fixed in pycares 4.9.0 by implementing a safe channel destruction mechanism.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pycares	sid	`5.0.1-3`	fixed
Debian	pycares	forky	`5.0.1-3`	fixed
Debian	pycares	trixie	`4.4.0-2`	vulnerable
Debian	pycares	bookworm	`4.3.0-2`	vulnerable
PyPI	pycares	Not reported	`4.9.0`	fixed
Opensuse	python-pycares	tumbleweed	`4.9.0-1.1`	fixed
Suse	python-pycares	linux enterprise module for python 3 15 sp6	`4.10.0-150400.9.8.1`	fixed
Suse	python-pycares	linux enterprise module for python 3 15 sp7	`4.10.0-150400.9.8.1`	fixed
Suse	python-pycares	linux enterprise high performance computing 15 sp4-espos	`4.10.0-150400.9.8.1`	fixed
Suse	python-pycares	linux enterprise high performance computing 15 sp4-ltss	`4.10.0-150400.9.8.1`	fixed
Suse	python-pycares	linux enterprise high performance computing 15 sp5-espos	`4.10.0-150400.9.8.1`	fixed
Suse	python-pycares	linux enterprise high performance computing 15 sp5-ltss	`4.10.0-150400.9.8.1`	fixed
Suse	python-pycares	linux enterprise server 15 sp4-ltss	`4.10.0-150400.9.8.1`	fixed
Suse	python-pycares	linux enterprise server 15 sp5-ltss	`4.10.0-150400.9.8.1`	fixed
Suse	python-pycares	linux enterprise server for sap applications 15 sp4	`4.10.0-150400.9.8.1`	fixed
Suse	python-pycares	linux enterprise server for sap applications 15 sp5	`4.10.0-150400.9.8.1`	fixed
Opensuse	python-pycares	leap 15.6	`4.10.0-150400.9.8.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pycares	source	sid	`4.9.0-1`	not yet assigned	Not reported	[1109377]
Debian	pycares	source	forky	`4.9.0-1`	not yet assigned	Not reported	[1109377]
Debian	pycares	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1109377]
Debian	pycares	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1109377]
PyPI	pycares	PyPI	Not reported	`4.9.0`	Not reported	GHSA-5QPG-RH4J-QP35	Not reported
Opensuse	python-pycares	rpm	tumbleweed	`4.9.0-1.1`	Not reported	OPENSUSE-SU-2025:15324-1	Not reported
Suse	python-pycares	rpm	linux enterprise module for python 3 15 sp6	`4.10.0-150400.9.8.1`	Not reported	SUSE-SU-2025:03354-1	Not reported
Suse	python-pycares	rpm	linux enterprise module for python 3 15 sp7	`4.10.0-150400.9.8.1`	Not reported	SUSE-SU-2025:03354-1	Not reported
Suse	python-pycares	rpm	linux enterprise high performance computing 15 sp4-espos	`4.10.0-150400.9.8.1`	Not reported	SUSE-SU-2025:03354-1	Not reported
Suse	python-pycares	rpm	linux enterprise high performance computing 15 sp4-ltss	`4.10.0-150400.9.8.1`	Not reported	SUSE-SU-2025:03354-1	Not reported
Suse	python-pycares	rpm	linux enterprise high performance computing 15 sp5-espos	`4.10.0-150400.9.8.1`	Not reported	SUSE-SU-2025:03354-1	Not reported
Suse	python-pycares	rpm	linux enterprise high performance computing 15 sp5-ltss	`4.10.0-150400.9.8.1`	Not reported	SUSE-SU-2025:03354-1	Not reported
Suse	python-pycares	rpm	linux enterprise server 15 sp4-ltss	`4.10.0-150400.9.8.1`	Not reported	SUSE-SU-2025:03354-1	Not reported
Suse	python-pycares	rpm	linux enterprise server 15 sp5-ltss	`4.10.0-150400.9.8.1`	Not reported	SUSE-SU-2025:03354-1	Not reported
Suse	python-pycares	rpm	linux enterprise server for sap applications 15 sp4	`4.10.0-150400.9.8.1`	Not reported	SUSE-SU-2025:03354-1	Not reported
Suse	python-pycares	rpm	linux enterprise server for sap applications 15 sp5	`4.10.0-150400.9.8.1`	Not reported	SUSE-SU-2025:03354-1	Not reported
Opensuse	python-pycares	rpm	leap 15.6	`4.10.0-150400.9.8.1`	Not reported	SUSE-SU-2025:03354-1	Not reported

[Debian bug #1109377]

Notes

[trixie] pycares: Minor issue, too intrusive to backport [bookworm] pycares: Minor issue, too intrusive to backport

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[python3-pycares]Affected
Source package: [pycares]
Details (2)
- 4.3.0-2 · amd64 · bookworm
  Affected
  dsa · pycares · debian · bookworm; dsa · pycares · debian · 12
- 4.3.0-2 · arm64 · bookworm
  Affected
  dsa · pycares · debian · bookworm; dsa · pycares · debian · 12
[python-pycares-doc]Affected
Source package: [pycares]
Details (2)
- 4.3.0-2 · all · bookworm
  Affected
  dsa · pycares · debian · bookworm; dsa · pycares · debian · 12
- 4.3.0-2 · all · bookworm
  Affected
  dsa · pycares · debian · bookworm; dsa · pycares · debian · 12

[Debian 13 (Trixie)]

[python3-pycares]Affected
Source package: [pycares]
Details (2)
- 4.4.0-2+b3 · amd64 · trixie
  Affected
  dsa · pycares · debian · 13
- 4.4.0-2+b4 · arm64 · trixie
  Affected
  dsa · pycares · debian · 13
[python-pycares-doc]Affected
Source package: [pycares]
Details (2)
- 4.4.0-2 · all · trixie
  Affected
  dsa · pycares · debian · 13
- 4.4.0-2 · all · trixie
  Affected
  dsa · pycares · debian · 13

[openSUSE Tumbleweed]

[python313-pycares]Unknown
Source package: [python-pycares]
Details (1)
- 5.0.1-1.5 · x86_64 · tumbleweed
  Unknown · Fixed: 4.9.0-1.1
  Version impact unknown
  dsa · python-pycares · opensuse · tumbleweed
[python314-pycares]Unknown
Source package: [python-pycares]
Details (1)
- 5.0.1-1.5 · x86_64 · tumbleweed
  Unknown · Fixed: 4.9.0-1.1
  Version impact unknown
  dsa · python-pycares · opensuse · tumbleweed

Observed: Oct 24, 2026, 9:52:41 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]