# CVE-2026-33630: c-ares use-after-free / double-free in query-completion handling

Source: https://junglewise.ai/threats/cve-2026-33630-c-ares-use-after-free-double-free-in-query-completion-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-33630 · Severity: high · CVSS 7.5 · Published 2026-09-03

c-ares is a widely-used library that applications rely on to perform asynchronous DNS lookups. A use-after-free vulnerability in its query handling allows an attacker or malicious callback to trigger a crash or potentially gain code execution by canceling a query from within its own completion callback, causing the library to free already-freed memory. This could destabilize services that depend on DNS resolution, leading to availability issues.

Technologies: [C-Ares](https://junglewise.ai/threats/technologies/c-ares). Vendors: [C-Ares](https://junglewise.ai/threats/vendors/c-ares).

## Quick answers

**Is CVE-2026-33630 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33630 being exploited in the wild.

**How severe is CVE-2026-33630?** High severity, with a CVSS score of 7.5, published 3 September 2026.

**Which products and versions are affected?** C-Ares 1.32.3 to 1.34.6.

**Is there a fix for CVE-2026-33630?** A patch was published on 2026-07-06: Fix committed to main and backported to v1.34 release branch; patched version 1.34.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33630 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33630?** Check whether you run C-Ares at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a use-after-free / double-free flaw in c-ares query-completion handling affecting versions 1.32.3 to 1.34.6. The root cause is that query callbacks are invoked while the query remains linked in the channel's internal lookup structures (queries_by_qid and all_queries). If a callback invokes ares_cancel() or frees the query, the query is then accessed and/or freed again by the caller (in process_timeouts(), read_answers(), or response handling). The vulnerability occurs at multiple points: timeout handling, response handling, and query dispatch. An attacker can exploit this through a malicious or reentrant callback that cancels itself, causing a double-free condition. The fix, available in version 1.34.7, detaches the query from internal structures before invoking the callback and defers retry re-dispatch to prevent stack overflow from unbounded recursion.

## Affected products

- c-ares c-ares 1.32.3 to 1.34.6

## Timeline

- 2026-09-03: disclosed: CVE-2026-33630 published
- 2026-07-06: patched: Fix committed to main and backported to v1.34 release branch; patched version 1.34.7 released

## References

- [https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc](https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc)
- [https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a](https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a)

## Related threats

- [c-ares DNS name parsing ReDoS](https://junglewise.ai/threats/cve-2026-69184-c-ares-is-an-asynchronous-resolver-library-prior-to-1-34-7-ares)
- [c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts…](https://junglewise.ai/threats/cve-2025-62408-c-ares-is-an-asynchronous-resolver-library-versions-1-32-3)