High [CVE-2026-33630] Use-after-free / double-free in query-completion handling
This high-severity Red Hat Linux advisory covers CVE-2026-33630 affecting Red Hat Enterprise Linux 10, Red Hat Hardened Images, Red Hat Enterprise Linux 6.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling.
The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch).
If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.
A flaw was found in c-ares. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafted DNS responses that force an EDNS-downgrade retry followed by a connection reset, causing the internal completion handler to access freed memory.
This leads to memory corruption and a crash (denial of service), with potential for further impact depending on the allocator and build configuration. An attacker can force the client onto TCP by setting the truncation (TC) bit in a UDP response.
This is a broader fix for the pattern previously addressed in CVE-2025-31498. All versions of c-ares prior to 1.34.7 are affected.
Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-416.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 17 days ago·verify at source
- 1.34.7
- c-ares-0:1.34.6-2.el10_2
- c-ares-main-1.34.7-1.hum1
- RHSA-2026:42096
- RHSA-2026:36192
Official advisory · high-confidence parse· fetched 17 days ago·verify at source
Mitigation checklist
- There is no complete mitigation for the remotely-triggered path. As a partial mitigation, use trusted DNS resolvers reached over a trusted transport (e.g., DNS-over-TLS). Avoid calling ares_cancel() from within a query callback to prevent the application-triggered path. Upgrade to c-ares 1.34.7 or later.
Official advisory · high-confidence parse· fetched 17 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.