c-ares TCP UAF - DNS-over-TCP FORMERR + RST Trigger Sequence (NDR)

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•2

Detects a specific DNS-over-TCP exploitation sequence used to trigger a Use-After-Free (UAF) vulnerability in the c-ares library. The rule monitors for a series of DNS responses from a resolver containing a FORMERR (RCODE=2) response without an OPT RR, followed immediately by a TCP Reset (RST) packet. This pattern is characteristic of the exploitation attempt against applications utilizing c-ares, such as Node.js, curl, gRPC, Envoy, and Wireshark.