CVE-2026-33630

A flaw was found in c-ares. A use-after-free / double-free vulnerability exists in the query-completion handling path, where a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafted DNS responses that force an EDNS-downgrade retry followed by a connection reset, causing the internal completion handler to access freed memory. This leads to memory corruption and a crash (denial of service), with potential for further impact depending on the allocator and build configuration.

A use-after-free / double-free vulnerability was found in c-ares' query-completion handling. The flaw is remotely exploitable without application cooperation via ares_getaddrinfo() over TCP: a malicious or on-path DNS server can force a specific sequence of responses (FORMERR without OPT record, duplicate query ID response, TCP reset) that causes the internal completion handler to access freed memory. An attacker can force the client onto TCP by setting the truncation (TC) bit in a UDP response.

The consequence is memory corruption leading to a crash (denial of service).

This is a broader fix for the pattern previously addressed in CVE-2025-31498. All versions of c-ares prior to 1.34.7 are affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no complete mitigation for the remotely-triggered path. As a partial mitigation, use trusted DNS resolvers reached over a trusted transport (e.g., DNS-over-TLS). Avoid calling ares_cancel() from within a query callback to prevent the application-triggered path. Upgrade to c-ares 1.34.7 or later.