CVE-2026-33630
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
c-ares is an asynchronous resolver library. From version 1.32.3 until 1.34.7, a use-after-free / double-free vulnerability exists in query-completion handling. The same flaw is present at multiple points in the resend/finish path.
Risk Assessment
The vulnerability could lead to program crashes or potentially arbitrary code execution if an attacker can control callbacks, posing a risk to applications using c-ares.
Recommendation
Update c-ares to version 1.34.7 or later, which contains the fix.
Other vulnerabilities in c-ares
See all- CVE-2017-1000381High
The `ares_parse_naptr_reply()` function in the c-ares library may read memory outside of the given input buffer if the passed DNS response packet is crafted in a specific way.
- CVE-2016-5180Critical
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a hostname with an escaped trailing dot.
- CVE-2026-69186Medium
In c-ares prior to 1.34.7, ares_dns_parse() trusted attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming the DNS response contained enough bytes. A malicious DNS response could cause disproportionate heap allocation for a tiny message, degrading or denying name resolution.
- CVE-2026-69184High
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size.
Original NVD description (English source)
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS