CVE-2026-33630

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33630", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-23T14:24:11.618Z", "datePublished": "2026-09-03T18:42:28.783Z", "dateUpdated": "2026-09-05T02:00:52.338Z"}, "containers": {"cna": {"title": "c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP", "problemTypes": [{"descriptions": [{"cweId": "CWE-415", "lang": "en", "description": "CWE-415: Double Free", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542"}, {"name": "https://github.com/c-ares/c-ares/pull/1237", "tags": ["x_refsource_MISC"], "url": "https://github.com/c-ares/c-ares/pull/1237"}, {"name": "https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc", "tags": ["x_refsource_MISC"], "url": "https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc"}, {"name": "https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a", "tags": ["x_refsource_MISC"], "url": "https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a"}, {"name": "https://github.com/c-ares/c-ares/releases/tag/v1.34.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/c-ares/c-ares/releases/tag/v1.34.7"}], "affected": [{"vendor": "c-ares", "product": "c-ares", "versions": [{"version": ">= 1.32.3, < 1.34.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-03T20:04:36.574Z"}, "descriptions": [{"lang": "en", "value": "c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw \u2014 a query's callback being invoked while the query is still linked in the channel's internal lookup structures \u2014 is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7."}], "source": {"advisory": "GHSA-6wfj-rwm7-3542", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-05T02:00:43.010024Z", "id": "CVE-2026-33630", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-05T02:00:52.338Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33630", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-05T02:00:43.010024Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-05T02:00:47.783Z"}}], "cna": {"title": "c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP", "source": {"advisory": "GHSA-6wfj-rwm7-3542", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "c-ares", "product": "c-ares", "versions": [{"status": "affected", "version": ">= 1.32.3, < 1.34.7"}]}], "references": [{"url": "https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542", "name": "https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/c-ares/c-ares/pull/1237", "name": "https://github.com/c-ares/c-ares/pull/1237", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc", "name": "https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a", "name": "https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/c-ares/c-ares/releases/tag/v1.34.7", "name": "https://github.com/c-ares/c-ares/releases/tag/v1.34.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw \u2014 a query's callback being invoked while the query is still linked in the channel's internal lookup structures \u2014 is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415: Double Free"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-03T20:04:36.574Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33630", "state": "PUBLISHED", "dateUpdated": "2026-09-05T02:00:52.338Z", "dateReserved": "2026-03-23T14:24:11.618Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-03T18:42:28.783Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "c-ares", "vendor": "c-ares", "versions": [{"status": "affected", "version": ">= 1.32.3, < 1.34.7"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw \u2014 a query's callback being invoked while the query is still linked in the channel's internal lookup structures \u2014 is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7."}], "id": "CVE-2026-33630", "lastModified": "2026-09-09T21:09:13.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33630", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-05T02:00:43.010024Z", "version": "2.0.3"}}]}, "published": "2026-09-03T19:17:27.420", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc"}, {"source": "security-advisories@github.com", "url": "https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a"}, {"source": "security-advisories@github.com", "url": "https://github.com/c-ares/c-ares/pull/1237"}, {"source": "security-advisories@github.com", "url": "https://github.com/c-ares/c-ares/releases/tag/v1.34.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}, {"lang": "en", "value": "CWE-416"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "c-ares: c-ares: Use-after-free / double-free in query-completion handling", "id": "2497686", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497686"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A flaw was found in c-ares. A use-after-free / double-free vulnerability exists in the query-completion handling path, where a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafted DNS responses that force an EDNS-downgrade retry followed by a connection reset, causing the internal completion handler to access freed memory. This leads to memory corruption and a crash (denial of service), with potential for further impact depending on the allocator and build configuration."], "mitigation": {"lang": "en:us", "value": "There is no complete mitigation for the remotely-triggered path. As a partial mitigation, use trusted DNS resolvers reached over a trusted transport (e.g., DNS-over-TLS). Avoid calling ares_cancel() from within a query callback to prevent the application-triggered path. Upgrade to c-ares 1.34.7 or later."}, "name": "CVE-2026-33630", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "c-ares", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "c-ares", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "c-ares", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "c-ares", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "c-ares", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "important", "package_name": "c-ares", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-07-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33630\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33630\nhttps://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc\nhttps://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a"], "statement": "A use-after-free / double-free vulnerability was found in c-ares' query-completion handling. The flaw is remotely exploitable without application cooperation via ares_getaddrinfo() over TCP: a malicious or on-path DNS server can force a specific sequence of responses (FORMERR without OPT record, duplicate query ID response, TCP reset) that causes the internal completion handler to access freed memory. An attacker can force the client onto TCP by setting the truncation (TC) bit in a UDP response.\nThe consequence is memory corruption leading to a crash (denial of service).\nThis is a broader fix for the pattern previously addressed in CVE-2025-31498. All versions of c-ares prior to 1.34.7 are affected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "c-ares", "vendor": "c-ares"}], "created": "2026-07-09T13:30:05.555005+00:00", "updated": "2026-09-03T21:45:09.669381+00:00", "vendors": ["c-ares", "c-ares$PRODUCT$c-ares"]}