Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-07T00:00:00 c-ares: c-ares: Use-after-free / double-free in query-completion handling 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-416

A flaw was found in c-ares. A use-after-free / double-free vulnerability exists in the query-completion handling path, where a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafted DNS responses that force an EDNS-downgrade retry followed by a connection reset, causing the internal completion handler to access freed memory. This leads to memory corruption and a crash (denial of service), with potential for further impact depending on the allocator and build configuration.

A use-after-free / double-free vulnerability was found in c-ares' query-completion handling. The flaw is remotely exploitable without application cooperation via ares_getaddrinfo() over TCP: a malicious or on-path DNS server can force a specific sequence of responses (FORMERR without OPT record, duplicate query ID response, TCP reset) that causes the internal completion handler to access freed memory. An attacker can force the client onto TCP by setting the truncation (TC) bit in a UDP response. The consequence is memory corruption leading to a crash (denial of service). This is a broader fix for the pattern previously addressed in CVE-2025-31498. All versions of c-ares prior to 1.34.7 are affected. There is no complete mitigation for the remotely-triggered path. As a partial mitigation, use trusted DNS resolvers reached over a trusted transport (e.g., DNS-over-TLS). Avoid calling ares_cancel() from within a query callback to prevent the application-triggered path. Upgrade to c-ares 1.34.7 or later. Red Hat Hardened Images 2026-07-07T00:00:00Z RHSA-2026:36192 c-ares-main-1.34.7-1.hum1 Red Hat Enterprise Linux 10 Affected c-ares Red Hat Enterprise Linux 6 Out of support scope c-ares Red Hat Enterprise Linux 7 Not affected c-ares Red Hat Enterprise Linux 8 Not affected c-ares Red Hat Enterprise Linux 9 Not affected c-ares Red Hat OpenShift Container Platform 4 Not affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-33630 https://nvd.nist.gov/vuln/detail/CVE-2026-33630 https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a