CVE-2026-33630: c-ares use-after-free / double-free in query-completion handling

CVE-2026-33630 · Severity: high · CVSS 7.5 · Published 2026-09-03

c-ares is a widely-used library that applications rely on to perform asynchronous DNS lookups. A use-after-free vulnerability in its query handling allows an attacker or malicious callback to trigger a crash or potentially gain code execution by canceling a query from within its own completion callback, causing the library to free already-freed memory. This could destabilize services that depend on DNS resolution, leading to availability issues.

Technologies: C-Ares. Vendors: C-Ares.

Quick answers

Is CVE-2026-33630 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33630 being exploited in the wild.
How severe is CVE-2026-33630?
High severity, with a CVSS score of 7.5, published 3 September 2026.
Which products and versions are affected?
C-Ares 1.32.3 to 1.34.6.
Is there a fix for CVE-2026-33630?
A patch was published on 2026-07-06: Fix committed to main and backported to v1.34 release branch; patched version 1.34.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33630 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33630?
Check whether you run C-Ares at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a use-after-free / double-free flaw in c-ares query-completion handling affecting versions 1.32.3 to 1.34.6. The root cause is that query callbacks are invoked while the query remains linked in the channel's internal lookup structures (queries_by_qid and all_queries). If a callback invokes ares_cancel() or frees the query, the query is then accessed and/or freed again by the caller (in process_timeouts(), read_answers(), or response handling). The vulnerability occurs at multiple points: timeout handling, response handling, and query dispatch. An attacker can exploit this through a malicious or reentrant callback that cancels itself, causing a double-free condition. The fix, available in version 1.34.7, detaches the query from internal structures before invoking the callback and defers retry re-dispatch to prevent stack overflow from unbounded recursion.

Affected products

  • c-ares c-ares 1.32.3 to 1.34.6

Timeline

  • 2026-09-03: disclosed: CVE-2026-33630 published
  • 2026-07-06: patched: Fix committed to main and backported to v1.34 release branch; patched version 1.34.7 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.