Description
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.
Published: 2026-09-03
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a use‑after‑free or double‑free in the c‑ares asynchronous resolver library. A query’s completion callback can be invoked while the query still remains linked in internal lookup structures. If the query or the owning host_query is freed by that callback, the library later accesses or frees the same memory again, leading to memory corruption. The fault can result in application crashes, which manifests as a denial of service. The weakness is categorized as CWE‑415 and CWE‑416.

Affected Systems

The c‑ares asynchronous resolver library versions 1.32.3 through 1.34.7 are affected. The flaw is triggered when a client uses ares_getaddrinfo() over a TCP connection. The issue was fixed in release 1.34.7.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The fault is remotely exploitable through normal use of ares_getaddrinfo() over TCP; however, the CVE data does not provide details about specific crafted inputs or callbacks, so the exact exploit path remains unspecified. The primary impact is a crash or denial of service.

Generated by OpenCVE AI on September 3, 2026 at 21:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade c‑ares to version 1.34.7 or later, which removes the use‑after‑free bug.
  • If an immediate upgrade is not possible, rebuild or configure c‑ares with a hardened memory allocator or implement run‑time bounds checking to reduce the risk of memory corruption.
  • Consider isolating DNS resolution in a separate process or network segment to limit the impact of a potential crash on the rest of the application.

Generated by OpenCVE AI on September 3, 2026 at 21:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 05 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
References

Thu, 03 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in c-ares. A use-after-free / double-free vulnerability exists in the query-completion handling path, where a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafted DNS responses that force an EDNS-downgrade retry followed by a connection reset, causing the internal completion handler to access freed memory. This leads to memory corruption and a crash (denial of service), with potential for further impact depending on the allocator and build configuration. c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.
Title c-ares: c-ares: Use-after-free / double-free in query-completion handling c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP
Weaknesses CWE-415
References

Thu, 09 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared C-ares
C-ares c-ares
Vendors & Products C-ares
C-ares c-ares

Thu, 09 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in c-ares. A use-after-free / double-free vulnerability exists in the query-completion handling path, where a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafted DNS responses that force an EDNS-downgrade retry followed by a connection reset, causing the internal completion handler to access freed memory. This leads to memory corruption and a crash (denial of service), with potential for further impact depending on the allocator and build configuration.
Title c-ares: c-ares: Use-after-free / double-free in query-completion handling
Weaknesses CWE-416
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Subscriptions

C-ares C-ares
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-05T02:00:52.338Z

Reserved: 2026-03-23T14:24:11.618Z

Link: CVE-2026-33630

cve-icon Vulnrichment

Updated: 2026-09-05T02:00:47.783Z

cve-icon NVD

Status : Received

Published: 2026-09-03T19:17:27.420

Modified: 2026-09-05T03:17:15.290

Link: CVE-2026-33630

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-07T00:00:00Z

Links: CVE-2026-33630 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T21:45:09Z

Weaknesses