CVE-2026-33630

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33630
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33630.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33630
Aliases
  • GHSA-6wfj-rwm7-3542
Downstream
Related
Published
2026-09-03T18:42:28.783Z
Modified
2026-09-04T11:45:58.672325582Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP
Details

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for aresgetaddrinfo() the owning hostquery, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33630.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-415",
        "CWE-416"
    ]
}
References

Affected packages

Git / github.com/c-ares/c-ares

Affected ranges

Type
GIT
Repo
https://github.com/c-ares/c-ares
Events
Introduced
5899dea2b1f8e78f311aaed7db98b82b5537c9f9
Fixed
d63b7de3a3568d14ab1351374b205365aed51cca
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "1.32.3"
        },
        {
            "fixed": "1.34.7"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33630.json"