{"id":"CVE-2026-33630","summary":"c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP","details":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.","aliases":["GHSA-6wfj-rwm7-3542"],"modified":"2026-09-14T18:26:52.656675105Z","published":"2026-09-03T18:42:28.783Z","related":["ALSA-2026:42096","SUSE-SU-2026:23364-1","SUSE-SU-2026:23414-1","SUSE-SU-2026:3872-1","SUSE-SU-2026:4021-1","openSUSE-SU-2026:11593-1","openSUSE-SU-2026:21721-1"],"database_specific":{"cwe_ids":["CWE-415","CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33630.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/c-ares/c-ares/releases/tag/v1.34.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33630.json"},{"type":"ADVISORY","url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33630"},{"type":"FIX","url":"https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc"},{"type":"FIX","url":"https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a"},{"type":"FIX","url":"https://github.com/c-ares/c-ares/pull/1237"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/c-ares/c-ares","events":[{"introduced":"5899dea2b1f8e78f311aaed7db98b82b5537c9f9"},{"fixed":"1fa3b86a0b8d18fe7b60f3228a01d770feb026bc"},{"fixed":"d823199b688052dcdc1646f2ab4cb8c16b1c644a"},{"fixed":"d63b7de3a3568d14ab1351374b205365aed51cca"}],"database_specific":{"extracted_events":[{"introduced":"1.32.3"},{"fixed":"1.34.7"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-33630.json","vanir_signatures_modified":"2026-09-11T08:58:49Z","vanir_signatures":[{"source":"https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc","target":{"file":"src/lib/ares_process.c","function":"process_timeouts"},"deprecated":false,"digest":{"length":609,"function_hash":"91174670012267509625080774280972626259"},"id":"CVE-2026-33630-07e03b06","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-33630-09e9f5e8","signature_type":"Line","signature_version":"v1","source":"https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a","target":{"file":"test/ares-test-mock.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["5575537314859015540383611567767234024","91047193105766777937234524208800444935","177188122338034081861117701975235246164","339722609565536490095992405430776999694","198991534290517888400294679848991361127","134041404277769598167599895347765467860"]}},{"digest":{"function_hash":"71456160217931919559138276882850671156","length":2290},"id":"CVE-2026-33630-1616bd20","signature_type":"Function","signature_version":"v1","source":"https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc","target":{"function":"ares_send_query","file":"src/lib/ares_process.c"},"deprecated":false},{"target":{"function":"process_answer","file":"src/lib/ares_process.c"},"deprecated":false,"digest":{"length":2021,"function_hash":"110281758974126944946843003155201137057"},"id":"CVE-2026-33630-1eeb67cb","signature_type":"Function","signature_version":"v1","source":"https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc"},{"target":{"function":"process_answer","file":"src/lib/ares_process.c"},"deprecated":false,"digest":{"length":2021,"function_hash":"110281758974126944946843003155201137057"},"id":"CVE-2026-33630-2a0b8e87","signature_type":"Function","signature_version":"v1","source":"https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc","target":{"file":"src/lib/ares_process.c","function":"read_answers"},"deprecated":false,"digest":{"length":1441,"function_hash":"303372442048542760988303472555081354521"},"id":"CVE-2026-33630-5381cf14"},{"id":"CVE-2026-33630-89410429","signature_type":"Function","signature_version":"v1","source":"https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a","target":{"file":"src/lib/ares_process.c","function":"read_answers"},"deprecated":false,"digest":{"function_hash":"303372442048542760988303472555081354521","length":1441}},{"source":"https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a","target":{"file":"src/lib/ares_process.c","function":"process_timeouts"},"deprecated":false,"digest":{"length":609,"function_hash":"91174670012267509625080774280972626259"},"id":"CVE-2026-33630-91af5c9e","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/lib/ares_process.c"},"deprecated":false,"digest":{"line_hashes":["42880497221162926242316517160235043031","263201677358337288119916018248864871932","145984597739005338546516973095749688216","223568079065217879678077567837544672860","152807300044003130649975949326924145889","340007517342290772117733873747610364052","213051138191345144583947327118690269893","339331415654239137036483700790448047683","225149743911565891826062996481248117018","167830722999962040807323839229064624300","135454170181978897353807291910341885219","288452243590791042174819041502664234576","209267455171673743919464206662262866772","270933436944881676298041107216303684946","131570388963334238653210309180820827234","157571494097026509353911556959781940803","87837146180322645244568765485980556876","271850450418336112952952631804465229767","132691469231284318892714103589576086514","195531986287226214541902270261671581807","222100338102444369287457738795606490185","39860281595491405785239875311645322025","334107973322096743195279020755896009948","101427953733361895251516126464298319845","197276443527329870743874032612390044874","303887873681134898299019057741063616717","51503713904037539300402197818467405592","24046411625569900493136191605824240714","25046279756501236749217343324898730886","240688078796009089384095718272739099669","313332821883522870990033448224486688718","82315576129084511433034485706806339851","135331322479616577288157665445265211055","97353282618743093725164880704087579169","50510348969794612604491066521262544050","211987745103795343067039275484932209930","324866776341107298989190973312126729172","285212904808204911565729393171695016465","194190463658120091973427654828940275997","270820711304639396253496919151432320512","286747681781913689545739137949172605015","179415776847258852797905398851049461481","6330406075818853376821113729320075460","50655109579264719734851453562554835019","88980774756854926025765374543763335017","70388790260476612180883450193781588884","320410001368501204643645345838705405284","337519579840074179799601892031109847317","323590101118443856276091155213740097243","281343831397002956055166940679333973389","270693883220802593534532717108956517287","18100648385059542186226504337846782002","249029342105541241925919978779897652367","92811325403708743685951541987983152122","186393743015151929125325587601919269157","145097833395735611427907706022343095062","281779201281665439871794900931417060171","235418530705587401014638334254133384605","51969898048256025239978358848509640416","232878477511439075225059429177191902220","142176360248179132279777659756102185292","226594666432831861545849810641388417073","55193858822402937628095182239981630766","210741608221189086052048984676632433482","134817161819287468556493283697319321086","102507645170794143536315477993430079878","300930413953455117059124119549816017212","314618607836123626855247548659434122971","39463838978072522968004865470731889450","50322177342957631961647580082772170405","335397488805066638924170615854815420260","159221402799285862548524890259827880273","216705988299882674489253002582714342651","44496625800698665271358717905535542622","248902723489311898818854783029436788511","108121810635577305775578609835028539950","99649335360084048206649071905478283294","303903256204947625039939511190761691297","168765408652858272137148748370853784707","88952155191216447827875751662392229753","96487353003771710671762601999199830666","322645155937008725888812412984228042270","265818847051941299405754792819396037454","296773745019746093918558293551431441037","296500047816707762600966028545925555098","212133424364868859896657951373653437749","299006646589568521111764358295150732121","246344083273737367240835014311098976103","251162878632085660838151803860766976137","338719394728260652384066707399550435229","339845288294908253905685360187686983157"],"threshold":0.9},"id":"CVE-2026-33630-9d6b9b57","signature_type":"Line","signature_version":"v1","source":"https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc"},{"id":"CVE-2026-33630-a02bc4d5","signature_type":"Line","signature_version":"v1","source":"https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a","target":{"file":"src/lib/ares_process.c"},"deprecated":false,"digest":{"line_hashes":["42880497221162926242316517160235043031","263201677358337288119916018248864871932","145984597739005338546516973095749688216","223568079065217879678077567837544672860","152807300044003130649975949326924145889","340007517342290772117733873747610364052","213051138191345144583947327118690269893","339331415654239137036483700790448047683","225149743911565891826062996481248117018","167830722999962040807323839229064624300","135454170181978897353807291910341885219","288452243590791042174819041502664234576","209267455171673743919464206662262866772","270933436944881676298041107216303684946","131570388963334238653210309180820827234","157571494097026509353911556959781940803","87837146180322645244568765485980556876","271850450418336112952952631804465229767","132691469231284318892714103589576086514","195531986287226214541902270261671581807","222100338102444369287457738795606490185","39860281595491405785239875311645322025","334107973322096743195279020755896009948","101427953733361895251516126464298319845","197276443527329870743874032612390044874","303887873681134898299019057741063616717","51503713904037539300402197818467405592","24046411625569900493136191605824240714","25046279756501236749217343324898730886","240688078796009089384095718272739099669","313332821883522870990033448224486688718","82315576129084511433034485706806339851","135331322479616577288157665445265211055","97353282618743093725164880704087579169","50510348969794612604491066521262544050","211987745103795343067039275484932209930","324866776341107298989190973312126729172","285212904808204911565729393171695016465","194190463658120091973427654828940275997","270820711304639396253496919151432320512","286747681781913689545739137949172605015","179415776847258852797905398851049461481","6330406075818853376821113729320075460","288209884734949900639851386101264863651","50655109579264719734851453562554835019","88980774756854926025765374543763335017","70388790260476612180883450193781588884","320410001368501204643645345838705405284","337519579840074179799601892031109847317","323590101118443856276091155213740097243","281343831397002956055166940679333973389","270693883220802593534532717108956517287","18100648385059542186226504337846782002","249029342105541241925919978779897652367","92811325403708743685951541987983152122","186393743015151929125325587601919269157","145097833395735611427907706022343095062","281779201281665439871794900931417060171","235418530705587401014638334254133384605","51969898048256025239978358848509640416","232878477511439075225059429177191902220","142176360248179132279777659756102185292","226594666432831861545849810641388417073","55193858822402937628095182239981630766","210741608221189086052048984676632433482","134817161819287468556493283697319321086","102507645170794143536315477993430079878","300930413953455117059124119549816017212","314618607836123626855247548659434122971","39463838978072522968004865470731889450","50322177342957631961647580082772170405","335397488805066638924170615854815420260","159221402799285862548524890259827880273","216705988299882674489253002582714342651","44496625800698665271358717905535542622","248902723489311898818854783029436788511","108121810635577305775578609835028539950","99649335360084048206649071905478283294","303903256204947625039939511190761691297","168765408652858272137148748370853784707","88952155191216447827875751662392229753","96487353003771710671762601999199830666","322645155937008725888812412984228042270","265818847051941299405754792819396037454","296773745019746093918558293551431441037","296500047816707762600966028545925555098","212133424364868859896657951373653437749","299006646589568521111764358295150732121","246344083273737367240835014311098976103","251162878632085660838151803860766976137","338719394728260652384066707399550435229","339845288294908253905685360187686983157"],"threshold":0.9}},{"digest":{"function_hash":"71456160217931919559138276882850671156","length":2290},"id":"CVE-2026-33630-e2a51412","signature_type":"Function","signature_version":"v1","source":"https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a","target":{"function":"ares_send_query","file":"src/lib/ares_process.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc","target":{"file":"test/ares-test-mock.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["5575537314859015540383611567767234024","91047193105766777937234524208800444935","177188122338034081861117701975235246164","339722609565536490095992405430776999694","198991534290517888400294679848991361127","134041404277769598167599895347765467860"]},"id":"CVE-2026-33630-f5e373a0","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}