Skip to content
Fencer Vulns
high 7.5

CVE-2026-33630 json

c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP

published 2026-09-03 2 mo ago modified 2026-09-09 1 mo ago also EUVD-2026-70664

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.

Patch / fix

  • c-ares c-ares 1.34.7
  • c-ares_project c-ares 1.34.7
  • c-ares Debian 14 1.34.7-1

debian advisories DEBIAN-CVE-2026-33630

  • c-ares Ubuntu 26.04 LTS 1.34.6-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2026-33630

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • c-ares RHEL 10.2 1.34.6-2.el10_2
  • c-ares hummingbird 1 1.34.7-1.hum1

red hat advisories RHSA-2026:42096RHSA-2026:36192

  • c-ares SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 1.34.8-150000.3.29.1
  • c-ares SLES for SAP applications 16.0, SLES 16.0 1.34.8-160000.1.1
  • c-ares Linux Micro 6.1 1.34.8-slfo.1.1_1.1
  • c-ares Linux Micro 6.0 1.34.8-1.1
  • libcares2 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.9.1-9.24.1

suse advisories SUSE-SU-2026:4021-1SUSE-SU-2026:23597-1SUSE-SU-2026:23414-1SUSE-SU-2026:3872-1SUSE-SU-2026:23364-1

  • c-ares openSUSE Leap 16.0 1.34.8-160000.1.1
  • c-ares openSUSE Tumbleweed 1.34.8-1.1

opensuse advisories openSUSE-SU-2026:21721-1openSUSE-SU-2026:11593-1

  • c-ares AlmaLinux 10 1.34.6-2.el10_2

almalinux advisories ALSA-2026:42096

  • c-ares Rocky Linux 10 1.34.6-2.el10_2

rocky linux advisories RLSA-2026:42096

  • c-ares Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 1.34.8-r0

alpine advisories ALPINE-CVE-2026-33630

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • fluent-bit Azure Linux 3.0 3.1.10-7

azure linux advisories AZL-99093

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-33630 updated cvss 7.5

c-ares: c-ares: Use-after-free / double-free in query-completion handling

  • Red Hat Enterprise Linux 6 c-ares
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 10) c-ares-devel 1.34.6-2.el10_2, c-ares-debuginfo 1.34.6-2.el10_2, c-ares-debugsource 1.34.6-2.el10_2 Red Hat Enterprise Linux BaseOS (v. 10) c-ares 1.34.6-2.el10_2
    fixed: vendor fix RHSA-2026:42096
  • Red Hat Hardened Images c-ares 1.34.7-1.hum1
    fixed: vendor fix RHSA-2026:36192
  • Red Hat Enterprise Linux 7 c-ares Red Hat Enterprise Linux 8 c-ares Red Hat Enterprise Linux 9 c-ares
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.84% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • c-ares c-ares

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.