CVE-2026-33630
HighSummary
A use-after-free and double-free vulnerability was found in the c-ares library in the query-completion handling path. The flaw occurs when a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafted data.
Risk Assessment
An attacker can remotely cause application crashes or potentially execute arbitrary code, leading to compromise of confidentiality, integrity, and availability.
Recommendation
Immediately update the c-ares library to the latest patched version. If an update is not possible, restrict access to services using c-ares to trusted sources only.
Other vulnerabilities in c-ares
See all- CVE-2017-1000381High
The `ares_parse_naptr_reply()` function in the c-ares library may read memory outside of the given input buffer if the passed DNS response packet is crafted in a specific way.
- CVE-2016-5180Critical
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a hostname with an escaped trailing dot.
Original NVD description (English source)
A flaw was found in c-ares. A use-after-free / double-free vulnerability exists in the query-completion handling path, where a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafte