CVE-2026-33630

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

• c-ares: c-ares: Use-after-free / double-free in query-completion handling (CVE-2026-33630)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

• c-ares: c-ares: Use-after-free / double-free in query-completion handling (CVE-2026-33630)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.

Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP. (CVE-2026-33630) CPU-exhaustion denial of service via unbounded DNS name compression pointer chains. (CVE-2026-69184) Memory-amplification denial of service via unvalidated DNS header record counts. (CVE-2026-69186)

These are all security issues fixed in the c-ares-devel-1.34.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update for c-ares fixes the following issues:

Updat to c-ares 1.36.8.

• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• For details, see https://c-ares.org/changelog.html.

Root has patched CVE-2026-33630 in the c-ares package for Root:Alpine:3.20. Multiple fixed versions available.

This update for c-ares fixes the following issues:

Update to c-ares 1.34.8.

• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).
• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• c-ares 1.34.8:
  • For details, see https://c-ares.org/changelog.html.
• c-ares 1.34.6:
  • Ignore Windows IDN Search Domains until proper IDN support is added.
  • Various bug fixes.
• c-ares 1.34.4:
  • Changes:
    • QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938
  • Bugfixes:
    • Empty TXT records were not being preserved. PR #922
    • docs: update deprecation notices for ares_create_query() and ares_mkquery(). PR #910
    • license: some files weren't properly updated. PR #920
    • Fix bind local device regression from 1.34.0. PR #929, PR #931, PR #935
    • CMake: set policy version to prevent deprecation warnings. PR #932
    • CMake: shared and static library names should be the same on unix platforms like autotools uses. PR #933
    • Update to latest autoconf archive macros for enhanced system compatibility. PR #936
• c-ares 1.34.3:
  • Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906
  • Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911
  • TSAN warns on missing lock, but lock isn't actually necessary. PR #915
  • ares_getaddrinfo() for AF_UNSPEC should retry IPv4 if only IPv6 is received. 765d558
  • ares_send() shouldn't return ARES_EBADRESP, its ARES_EBADQUERY. 91519e7
  • Fix typos in man pages. PR #905
• c-ares 1.34.2:
  • Features:
    • adig: read arguments from adigrc. [PR #856]
    • Add new pending write callback optimization via ares_set_pending_write_cb. [PR #857]
    • New function ares_process_fds(). [PR #875]
    • Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]
    • adig: rework command line arguments to mimic dig from bind. [PR #890]
    • Add new method for overriding network functions ares_set_socket_function_ex() to properly support all new functionality. [PR #894]
    • Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]
    • ares_socket: set IP_BIND_ADDRESS_NO_PORT on ares_set_local_ip* tcp sockets [PR #887]
    • URI parser/writer for ares_set_servers_csv()/ares_get_servers_csv(). [PR #882]
    • Connection handling modularization. [PR #857], [PR #876]
    • Expose library/utility functions to tools. [PR #860]
    • Remove ares__ prefix, just use ares_ for internal functions. [PR #872]
    • fix: potential WIN32_LEAN_AND_MEAN redefinition. [PR #869]
    • Fix googletest v1.15 compatibility. [PR #874]
    • Fix pkgconfig thread dependencies. [PR #884]
• c-ares 1.33.0:
  • Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]
  • Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]
  • Reorganize source tree. [PR #822]
  • Refactoring of connection handling to prevent code duplication. [PR #839]
  • New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]
  • ares_destroy() race condition during shutdown due to missing lock. [PR #831]
• c-ares in 1.32:
  • Add support for DNS 0x20 to help prevent cache poisoning attacks, enabled by specifying…

This update for c-ares fixes the following issues:

Update to c-ares 1.34.8.

• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).
• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• c-ares 1.34.8:
  • For details, see https://c-ares.org/changelog.html.
• c-ares 1.34.6:
  • Ignore Windows IDN Search Domains until proper IDN support is added.
  • Various bug fixes.
• c-ares 1.34.4:
  • Changes:
    • QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938
  • Bugfixes:
    • Empty TXT records were not being preserved. PR #922
    • docs: update deprecation notices for ares_create_query() and ares_mkquery(). PR #910
    • license: some files weren't properly updated. PR #920
    • Fix bind local device regression from 1.34.0. PR #929, PR #931, PR #935
    • CMake: set policy version to prevent deprecation warnings. PR #932
    • CMake: shared and static library names should be the same on unix platforms like autotools uses. PR #933
    • Update to latest autoconf archive macros for enhanced system compatibility. PR #936
• c-ares 1.34.3:
  • Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906
  • Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911
  • TSAN warns on missing lock, but lock isn't actually necessary. PR #915
  • ares_getaddrinfo() for AF_UNSPEC should retry IPv4 if only IPv6 is received. 765d558
  • ares_send() shouldn't return ARES_EBADRESP, its ARES_EBADQUERY. 91519e7
  • Fix typos in man pages. PR #905
• c-ares 1.34.2:
  • Features:
    • adig: read arguments from adigrc. [PR #856]
    • Add new pending write callback optimization via ares_set_pending_write_cb. [PR #857]
    • New function ares_process_fds(). [PR #875]
    • Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]
    • adig: rework command line arguments to mimic dig from bind. [PR #890]
    • Add new method for overriding network functions ares_set_socket_function_ex() to properly support all new functionality. [PR #894]
    • Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]
    • ares_socket: set IP_BIND_ADDRESS_NO_PORT on ares_set_local_ip* tcp sockets [PR #887]
    • URI parser/writer for ares_set_servers_csv()/ares_get_servers_csv(). [PR #882]
    • Connection handling modularization. [PR #857], [PR #876]
    • Expose library/utility functions to tools. [PR #860]
    • Remove ares__ prefix, just use ares_ for internal functions. [PR #872]
    • fix: potential WIN32_LEAN_AND_MEAN redefinition. [PR #869]
    • Fix googletest v1.15 compatibility. [PR #874]
    • Fix pkgconfig thread dependencies. [PR #884]
• c-ares 1.33.0:
  • Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]
  • Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]
  • Reorganize source tree. [PR #822]
  • Refactoring of connection handling to prevent code duplication. [PR #839]
  • New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]
  • ares_destroy() race condition during shutdown due to missing lock. [PR #831]
• c-ares in 1.32:
  • Add support for DNS 0x20 to help prevent cache poisoning attacks, enabled by specifying…

This update for c-ares fixes the following issues:

Updat to c-ares 1.36.8.

• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• For details, see https://c-ares.org/changelog.html.

This update for libcares2 fixes the following issues:

• CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).

This update for c-ares fixes the following issues:

• CVE-2024-25629: out of bounds read in ares__read_line() (bsc#1220279).
• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
• CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: Memory-amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• updated to 1.36.8.

It was discovered that c-ares incorrectly handled certain query completion callbacks. An attacker could possibly use this issue to trigger a use- after-free or double-free, resulting in a denial of service or arbitrary code execution.