CVE-2026-33630: c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP
c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via aresgetaddrinfo() over TCP
Other sources
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for aresgetaddrinfo() the owning hostquery, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.10-7 - Upgrade
Upgrade
c-aresto a version that resolves this vulnerability.Fixed in 1.34.7Patch CVE-2026-33630 - Upgrade
Upgrade
c-aresto a version that resolves this vulnerability.Fixed in 1.34.7Patch GHSA-pjmc-gx33-gc76 - Upgrade
Upgrade
c-aresto a version that resolves this vulnerability.Fixed in 1.34.7Patch GHSA-jv8r-gqr9-68wj
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Applications using c-ares through ares_getaddrinfo() and performing DNS resolution over TCP are described as remotely triggerable. The affected versions are 1.32.3 through 1.34.7.
Does exploitation require an authenticated user or user interaction?
No. The supplied vector indicates network access, low attack complexity, no privileges required, and no user interaction.
What is the remediation?
Update c-ares to the fixed 1.34.7 release. The provided data does not identify a workaround for environments that cannot patch immediately.
What behavior indicates an affected application path?
The vulnerable condition occurs when a query callback frees the query, or when an ares_getaddrinfo() callback frees its owning host_query, while it remains linked in c-ares internal lookup structures. Subsequent processing can then access or free that object again.