CVE-2026-33630
Received Received - Intake

Use-After-Free in c-ares DNS Resolver Library

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-33630
EUVD
EUVD-2026-70664

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
curl libc_ares From 1.32.3 (inc) to 1.34.7 (inc)
curl libc_ares 1.34.7
cares cares From 1.32.3 (inc) to 1.34.7 (inc)
cares cares 1.34.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free and double-free vulnerability in the c-ares library affecting versions 1.32.3 through 1.34.6. It occurs when a query's callback is invoked while the query is still linked in the channel's internal lookup structures. If the query or related host_query is freed during this callback, it leads to accessing and freeing the same memory twice.

Detection Guidance

This vulnerability can be detected by checking the version of c-ares installed on your system. If the version is between 1.32.3 and 1.34.6, it is vulnerable. Use commands like 'c-ares-config --version' or 'ldconfig -p | grep cares' to check the installed version.

Impact Analysis

This flaw could allow an attacker to cause a denial of service or potentially execute arbitrary code if they can trigger the specific conditions leading to the double-free or use-after-free scenario in applications using vulnerable versions of c-ares.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially causing denial-of-service conditions or arbitrary code execution, which may lead to unauthorized data access or processing disruptions. Such incidents could violate data integrity, availability, or confidentiality requirements under these regulations.

Mitigation Strategies

Immediately upgrade c-ares to version 1.34.7 or later. If upgrading is not possible, consider disabling affected services or applications that rely on vulnerable versions of c-ares until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33630. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart