CVE-2026-33630 Details

A use-after-free and double-free vulnerability has been identified in the c-ares library, specifically in versions 1.32.3 prior to 1.34.7. This vulnerability arises in the asynchronous query-completion process, where a query's callback can be triggered while the query is still active in the channel's internal lookup structures. This issue occurs in several scenarios, including timeout and response handling, as well as during query dispatch. If a query or its associated host_query (in the case of ares_getaddrinfo()) is freed by the callback, it can be accessed and freed again, leading to memory corruption.

Users are advised to upgrade to c-ares version 1.34.7, where this vulnerability has been fixed. In the meantime, avoid calling ares_cancel() from within query callbacks, although this does not address the vulnerability's remote exploitation.