Executive brief
c-ares is a widely-used library that applications rely on to perform asynchronous DNS lookups. A use-after-free vulnerability in its query handling allows an attacker or malicious callback to trigger a crash or potentially gain code execution by canceling a query from within its own completion callback, causing the library to free already-freed memory. This could destabilize services that depend on DNS resolution, leading to availability issues.
Technical details
The vulnerability is a use-after-free / double-free flaw in c-ares query-completion handling affecting versions 1.32.3 to 1.34.6. The root cause is that query callbacks are invoked while the query remains linked in the channel's internal lookup structures (queries_by_qid and all_queries). If a callback invokes ares_cancel() or frees the query, the query is then accessed and/or freed again by the caller (in process_timeouts(), read_answers(), or response handling). The vulnerability occurs at multiple points: timeout handling, response handling, and query dispatch. An attacker can exploit this through a malicious or reentrant callback that cancels itself, causing a double-free condition. The fix, available in version 1.34.7, detaches the query from internal structures before invoking the callback and defers retry re-dispatch to prevent stack overflow from unbounded recursion.
Affected products
- c-ares c-ares 1.32.3 to 1.34.6
Timeline
- 2026-09-03: disclosed: CVE-2026-33630 published
- 2026-07-06: patched: Fix committed to main and backported to v1.34 release branch; patched version 1.34.7 released