{"id":"CVE-2026-33630","aliases":["ALPINE-CVE-2026-33630","ALSA-2026:42096","AZL-99093","AZL-99095","BELL-CVE-2026-33630","DEBIAN-CVE-2026-33630","EUVD-2026-70664","GHSA-6wfj-rwm7-3542","MGASA-2026-0343","RHSA-2026:36192","RHSA-2026:42096","RLSA-2026:42096","ROOT-OS-ALPINE-320-CVE-2026-33630","SUSE-SU-2026:23364-1","SUSE-SU-2026:23414-1","SUSE-SU-2026:23597-1","SUSE-SU-2026:3872-1","SUSE-SU-2026:4021-1","UBUNTU-CVE-2026-33630","USN-8844-1","openSUSE-SU-2026:11593-1","openSUSE-SU-2026:21721-1"],"status":"published","title":"c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP","description":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00845,"percentile":0.58301,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415","CWE-416"],"published":"2026-07-09T14:53:04.300671Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"c-ares","fixed_in":["1.34.6-2.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"c-ares-devel","fixed_in":["1.34.6-2.el10_2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"fluent-bit","fixed_in":["3.1.10-7"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"c-ares","fixed_in":["1.34.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"c-ares","fixed_in":["1.34.7-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"c-ares","fixed_in":["0:1.34.7-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"c-ares-devel","fixed_in":["0:1.34.7-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"c-ares-debuginfo","fixed_in":["0:1.34.6-2.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"c-ares-debugsource","fixed_in":["0:1.34.6-2.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"c-ares-devel","fixed_in":["0:1.34.6-2.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"c-ares","fixed_in":["0:1.34.6-2.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"c-ares","fixed_in":["0:1.34.6-2.el10_2"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"c-ares","fixed_in":["1.33.1-r00072","1.33.1-r00073","1.33.1-r00074"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-c-ares","fixed_in":["1.33.1-r00072","1.33.1-r00073","1.33.1-r00074"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"c-ares","fixed_in":["1.34.6-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.6-2.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"c-ares-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.6-2.el10_2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fluent-bit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"24.18.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.5-r0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.1-r1"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34.5-r0"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.1-r1"},{"fixed":"1.34.8-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34.5-1","1.34.5-1+deb13u1","1.34.6-1","1.34.7-1","1.34.8-1"]},{"source":"osv","ecosystem":"Debian:14","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.7-1"}]}],"versions":["1.34.5-1","1.34.6-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.7-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"c-ares-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.7-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"c-ares-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.6-2.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"c-ares-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.6-2.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"c-ares-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.6-2.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.6-2.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.6-2.el10_2"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-r00072"},{"fixed":"1.33.1-r00073"},{"fixed":"1.33.1-r00074"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-r00072"},{"fixed":"1.33.1-r00073"},{"fixed":"1.33.1-r00074"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-slfo.1.1_1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-9.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-9.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-150000.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34.4-2.1","1.34.5-1","1.34.5-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.6-1ubuntu0.1"}]}],"versions":["1.34.5-1","1.34.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.6-1ubuntu0.1"}]}],"versions":["1.34.5-1","1.34.6-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-160000.1.1"}]}],"bundled":3}],"products":[{"vendor":"c-ares","product":"c-ares"}],"references":[{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542","tags":["x_refsource_CONFIRM","advisory","report"]},{"url":"https://github.com/c-ares/c-ares/pull/1237","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/c-ares/c-ares/releases/tag/v1.34.7","tags":["x_refsource_MISC","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-33630","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42096","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33630","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497686","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-42096.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33630","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-33630","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33630.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33630","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0343.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35847","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/06/8","tags":["web","report"]},{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RP4OX63ZTYCCB4UK6HI4BFEPQEPSNLOJ/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36192","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36192.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497686","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33630","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42096.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:42096","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623364-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240955","tags":["report"]},{"url":"https://bugzilla.suse.com/1254738","tags":["report"]},{"url":"https://bugzilla.suse.com/1270416","tags":["report"]},{"url":"https://bugzilla.suse.com/1276290","tags":["report"]},{"url":"https://bugzilla.suse.com/1276291","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623414-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623597-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263872-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264021-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220279","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25629","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-33630","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8844-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-33630","title":"c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP","description":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.","status":"published","published":"2026-09-03T18:42:28.783Z","modified":"2026-09-05T02:00:52.338Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-415","CWE-416"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-70664","description":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.","status":"published","published":"2026-09-03T18:42:28Z","modified":"2026-09-05T02:00:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:11.238356Z"}],"nvd":[{"id":"CVE-2026-33630","description":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.","status":"published","published":"2026-09-03T19:17:27.42Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-415","CWE-416"],"updated_at":"2026-11-02T14:12:43.737972Z"}],"osv":[{"id":"ALPINE-CVE-2026-33630","description":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.","status":"published","published":"2026-09-03T19:17:27.42Z","modified":"2026-10-01T02:17:49.248933005Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-33630","status":"published","published":"2026-07-09T14:53:04.300671Z","modified":"2026-09-05T07:15:04.204420855Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-33630","title":"c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP","description":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.","status":"published","published":"2026-09-03T18:42:28.783Z","modified":"2026-10-28T11:12:01.456852376Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-415","CWE-416"],"updated_at":"2026-11-02T15:45:01.896044Z"},{"id":"DEBIAN-CVE-2026-33630","description":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.","status":"published","published":"2026-09-03T19:17:27.42Z","modified":"2026-10-01T03:03:10.89467627Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"RHSA-2026:36192","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-16T10:09:16Z","modified":"2026-10-06T10:31:25.751802047Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:42096","title":"Red Hat Security Advisory: c-ares security update","status":"published","published":"2026-07-23T10:14:00Z","modified":"2026-09-04T10:09:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RLSA-2026:42096","title":"Important: c-ares security update","description":"The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.\n\nSecurity Fix(es):\n\n* c-ares: c-ares: Use-after-free / double-free in query-completion handling (CVE-2026-33630)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-22T12:05:54.42934Z","modified":"2026-07-22T12:30:06.95970936Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-33630","description":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.","status":"published","published":"2026-09-03T19:17:00Z","modified":"2026-09-29T23:41:46.28647597Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"ALSA-2026:42096","title":"Important: c-ares security update","description":"The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.  \n\nSecurity Fix(es):  \n\n  * c-ares: c-ares: Use-after-free / double-free in query-completion handling (CVE-2026-33630)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-20T00:00:00Z","modified":"2026-10-29T11:30:35.338651289Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-99093","title":"CVE-2026-33630 affecting package fluent-bit for versions less than 3.1.10-7","description":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.","status":"published","published":"2026-09-03T19:17:27Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99095","title":"CVE-2026-33630 affecting package nodejs 24.18.1-1","description":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.","status":"published","published":"2026-09-03T19:17:27Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"MGASA-2026-0343","title":"Updated c-ares packages fix security vulnerabilities","description":"Use-after-free / double-free in c-ares query-completion handling,\nremotely triggerable via ares_getaddrinfo() over TCP. (CVE-2026-33630)\nCPU-exhaustion denial of service via unbounded DNS name compression\npointer chains. (CVE-2026-69184)\nMemory-amplification denial of service via unvalidated DNS header record\ncounts. (CVE-2026-69186)\n","status":"published","published":"2026-08-31T16:22:02Z","modified":"2026-08-31T16:30:04.403545003Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11593-1","title":"c-ares-devel-1.34.8-1.1 on GA media","description":"These are all security issues fixed in the c-ares-devel-1.34.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-25T00:00:00Z","modified":"2026-08-26T10:15:03.389391117Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21721-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdat to c-ares 1.36.8.\n\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- For details, see https://c-ares.org/changelog.html.\n","status":"published","published":"2026-09-01T15:48:33Z","modified":"2026-09-02T18:00:03.313428309Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2026-33630","title":"CVE-2026-33630 in c-ares - Patched by Root","description":"Root has patched CVE-2026-33630 in the c-ares package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-10-07T09:08:38Z","modified":"2026-10-07T10:15:07.520509939Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"SUSE-SU-2026:23364-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdate to c-ares 1.34.8.\n\n- CVE-2025-31498: use-after-free in `read_answers()` when `process_answer()` may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- c-ares 1.34.8:\n  * For details, see https://c-ares.org/changelog.html.\n- c-ares 1.34.6:\n  * Ignore Windows IDN Search Domains until proper IDN support is added.\n  * Various bug fixes.\n- c-ares 1.34.4:\n  * Changes:\n    -  QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938\n  * Bugfixes:\n    - Empty TXT records were not being preserved. PR #922\n    - `docs`: update deprecation notices for `ares_create_query()` and `ares_mkquery()`. PR #910\n    - `license`: some files weren't properly updated. PR #920\n    - Fix `bind` local device regression from 1.34.0. PR #929, PR #931, PR #935\n    - `CMake`: set policy version to prevent deprecation warnings. PR #932\n    - `CMake`: shared and static library names should be the same on unix platforms like `autotools` uses. PR #933\n    - Update to latest `autoconf` archive macros for enhanced system compatibility. PR #936\n- c-ares 1.34.3:\n  * Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906\n  * Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911\n  * TSAN warns on missing lock, but lock isn't actually necessary. PR #915\n  * `ares_getaddrinfo(`) for `AF_UNSPEC` should retry IPv4 if only IPv6 is received. 765d558\n  * `ares_send()` shouldn't return `ARES_EBADRESP`, its `ARES_EBADQUERY`. 91519e7\n  * Fix typos in man pages. PR #905\n- c-ares 1.34.2:\n  * Features:\n    - `adig`: read arguments from `adigrc`. [PR #856]\n    - Add new pending write callback optimization via `ares_set_pending_write_cb`. [PR #857]\n    - New function `ares_process_fds()`. [PR #875]\n    - Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]\n    - `adig`: rework command line arguments to mimic `dig` from `bind`. [PR #890]\n    - Add new method for overriding network functions `ares_set_socket_function_ex()` to properly support all new\n      functionality. [PR #894]\n    - Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]\n    - `ares_socket`: set `IP_BIND_ADDRESS_NO_PORT` on `ares_set_local_ip*` tcp sockets [PR #887]\n    - URI parser/writer for `ares_set_servers_csv()`/`ares_get_servers_csv()`. [PR #882]\n    - Connection handling modularization. [PR #857], [PR #876]\n    - Expose library/utility functions to tools. [PR #860]\n    - Remove `ares__` prefix, just use `ares_` for internal functions. [PR #872]\n    - fix: potential `WIN32_LEAN_AND_MEAN` redefinition. [PR #869]\n    - Fix `googletest` v1.15 compatibility. [PR #874]\n    - Fix `pkgconfig` thread dependencies. [PR #884]\n- c-ares 1.33.0:\n  * Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]\n  * Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]\n  * Reorganize source tree. [PR #822]\n  * Refactoring of connection handling to prevent code duplication. [PR #839]\n  * New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]\n  * `ares_destroy()` race condition during shutdown due to missing lock. [PR #831]\n- c-ares in 1.32:\n  * Add support for DNS `0x20` to help prevent cache poisoning attacks, enabled by specifying `ARES_FLAG_DNS0x20`.\n    Disabled by default. [PR #800]\n  * Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now\n    is only used as a hint until there is enough history to calculate a more valid timeout. [PR #794]\n  * DNS RR `TXT` strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order\n    to maintain ABI compliance, the ability to retrieve `TXT` strings concatenated is retained as well as a new API to\n    retrieve the individual strings. This restores behavior from c-ares 1.20.0. [PR #801]\n  * Clean up header inclusion logic to make hacking on code easier. [PR #797]\n  * GCC/Clang: Enable even more strict warnings to catch more coding flaws. [253bdee]\n  * Tests: Fix thread race condition in test cases for `EventThread`. [PR #803]\n  * Thread Saftey: `ares_timeout()` was missing lock. [74a64e4]\n- c-ares 1.31.0:\n  * Enable Query Cache by default. [PR #786]\n  * Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. [PR #785]\n  * Various legacy MacOS Build fixes. [Issue #782]\n  * Ndots value of zero in `resolv.conf` was not being honored. [852a60a]\n  * Watt-32 build support had been broken for some time. [PR #781]\n  * Distribute `ares_dns_rec_type_tostr` manpage. [PR #778]\n- c-ares 1.30.0:\n  * Basic support for SIG RR record (RFC 2931 / RFC 2535) [PR #773]\n  * Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure.\n    [75de16c] and [40fb125]\n  * `QueryCache`: Fix issue where purging on server changes wasn't working. [a6c8fe6]\n- c-ares 1.29.0:\n  * When using `ARES_OPT_EVENT_THREAD`, automatically reload system configuration when network conditions change.\n    [PR #759]\n  * Apple: reimplement DNS configuration reading to more accurately pull DNS settings. [PR #750]\n  * Add observability into DNS server health via a server state callback, invoked whenever a query finishes. [PR #744]\n  * Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay.\n    [PR #731]\n  * Mark `ares_channel_t *` as `const` in more places in the public API. [PR #758]\n  * Due to a logic flaw, dns name compression writing was not properly implemented which would result in the name prefix\n    not being written for a partial match. This could cause issues in various record types such as `MX` records when\n    using the deprecated API. Regression introduced in 1.28.0. [Issue #757]\n  * Revert OpenBSD `SOCK_DNS` flag, it doesn't do what the docs say it does and causes c-ares to become non-functional.\n    [PR #754]\n  * `ares_getnameinfo()`: loosen validation on `salen` parameter. [Issue #752]\n  * `cmake`: Android requires C99. [PR #748]\n  * `ares_queue_wait_empty()` does not honor `timeout_ms \u003e= 0`. [Issue #742]\n- c-ares 1.28.1:\n  * Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of\n   `CARES_NO_DEPRECATED`. [PR #732]\n  * Add function `ares_search_dnsrec()` to search for records using the new DNS record data structures. [PR #719]\n  * Rework internals to pass around `ares_dns_record_t` instead of binary data, this introduces new public functions of\n    `ares_query_dnsrec()` and `ares_send_dnsrec()`. [PR #730]\n  * tests: when performing simulated queries, reduce timeouts to make tests run faster.\n  * Replace configuration file parsers with memory-safe parser. [PR #725]\n  * Remove `acountry` completely, the manpage might still get installed otherwise. [Issue #718]\n  * CMake: don't overwrite global required libraries/definitions/includes which could cause build errors for projects\n    chain building c-ares. [Issue #729]\n  * On some platforms, `netinet6/in6.h` is not included by `netinet/in.h` and needs to be included separately. [PR #728]\n  * Fix a potential memory leak in `ares_init()`. [Issue #724]\n  * Some platforms don't have the `isascii()` function. Implement as a macro. [PR #721]\n  * CMake: Fix chain building if `CMAKE` runtime paths not set.\n  * NDots configuration should allow a value of zero. [PR #735]\n","status":"published","published":"2026-08-28T11:28:12Z","modified":"2026-09-10T18:23:13.347908946Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23414-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdate to c-ares 1.34.8.\n\n- CVE-2025-31498: use-after-free in `read_answers()` when `process_answer()` may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- c-ares 1.34.8:\n  * For details, see https://c-ares.org/changelog.html.\n- c-ares 1.34.6:\n  * Ignore Windows IDN Search Domains until proper IDN support is added.\n  * Various bug fixes.\n- c-ares 1.34.4:\n  * Changes:\n    -  QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938\n  * Bugfixes:\n    - Empty TXT records were not being preserved. PR #922\n    - `docs`: update deprecation notices for `ares_create_query()` and `ares_mkquery()`. PR #910\n    - `license`: some files weren't properly updated. PR #920\n    - Fix `bind` local device regression from 1.34.0. PR #929, PR #931, PR #935\n    - `CMake`: set policy version to prevent deprecation warnings. PR #932\n    - `CMake`: shared and static library names should be the same on unix platforms like `autotools` uses. PR #933\n    - Update to latest `autoconf` archive macros for enhanced system compatibility. PR #936\n- c-ares 1.34.3:\n  * Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906\n  * Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911\n  * TSAN warns on missing lock, but lock isn't actually necessary. PR #915\n  * `ares_getaddrinfo(`) for `AF_UNSPEC` should retry IPv4 if only IPv6 is received. 765d558\n  * `ares_send()` shouldn't return `ARES_EBADRESP`, its `ARES_EBADQUERY`. 91519e7\n  * Fix typos in man pages. PR #905\n- c-ares 1.34.2:\n  * Features:\n    - `adig`: read arguments from `adigrc`. [PR #856]\n    - Add new pending write callback optimization via `ares_set_pending_write_cb`. [PR #857]\n    - New function `ares_process_fds()`. [PR #875]\n    - Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]\n    - `adig`: rework command line arguments to mimic `dig` from `bind`. [PR #890]\n    - Add new method for overriding network functions `ares_set_socket_function_ex()` to properly support all new\n      functionality. [PR #894]\n    - Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]\n    - `ares_socket`: set `IP_BIND_ADDRESS_NO_PORT` on `ares_set_local_ip*` tcp sockets [PR #887]\n    - URI parser/writer for `ares_set_servers_csv()`/`ares_get_servers_csv()`. [PR #882]\n    - Connection handling modularization. [PR #857], [PR #876]\n    - Expose library/utility functions to tools. [PR #860]\n    - Remove `ares__` prefix, just use `ares_` for internal functions. [PR #872]\n    - fix: potential `WIN32_LEAN_AND_MEAN` redefinition. [PR #869]\n    - Fix `googletest` v1.15 compatibility. [PR #874]\n    - Fix `pkgconfig` thread dependencies. [PR #884]\n- c-ares 1.33.0:\n  * Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]\n  * Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]\n  * Reorganize source tree. [PR #822]\n  * Refactoring of connection handling to prevent code duplication. [PR #839]\n  * New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]\n  * `ares_destroy()` race condition during shutdown due to missing lock. [PR #831]\n- c-ares in 1.32:\n  * Add support for DNS `0x20` to help prevent cache poisoning attacks, enabled by specifying `ARES_FLAG_DNS0x20`.\n    Disabled by default. [PR #800]\n  * Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now\n    is only used as a hint until there is enough history to calculate a more valid timeout. [PR #794]\n  * DNS RR `TXT` strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order\n    to maintain ABI compliance, the ability to retrieve `TXT` strings concatenated is retained as well as a new API to\n    retrieve the individual strings. This restores behavior from c-ares 1.20.0. [PR #801]\n  * Clean up header inclusion logic to make hacking on code easier. [PR #797]\n  * GCC/Clang: Enable even more strict warnings to catch more coding flaws. [253bdee]\n  * Tests: Fix thread race condition in test cases for `EventThread`. [PR #803]\n  * Thread Saftey: `ares_timeout()` was missing lock. [74a64e4]\n- c-ares 1.31.0:\n  * Enable Query Cache by default. [PR #786]\n  * Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. [PR #785]\n  * Various legacy MacOS Build fixes. [Issue #782]\n  * Ndots value of zero in `resolv.conf` was not being honored. [852a60a]\n  * Watt-32 build support had been broken for some time. [PR #781]\n  * Distribute `ares_dns_rec_type_tostr` manpage. [PR #778]\n- c-ares 1.30.0:\n  * Basic support for SIG RR record (RFC 2931 / RFC 2535) [PR #773]\n  * Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure.\n    [75de16c] and [40fb125]\n  * `QueryCache`: Fix issue where purging on server changes wasn't working. [a6c8fe6]\n- c-ares 1.29.0:\n  * When using `ARES_OPT_EVENT_THREAD`, automatically reload system configuration when network conditions change.\n    [PR #759]\n  * Apple: reimplement DNS configuration reading to more accurately pull DNS settings. [PR #750]\n  * Add observability into DNS server health via a server state callback, invoked whenever a query finishes. [PR #744]\n  * Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay.\n    [PR #731]\n  * Mark `ares_channel_t *` as `const` in more places in the public API. [PR #758]\n  * Due to a logic flaw, dns name compression writing was not properly implemented which would result in the name prefix\n    not being written for a partial match. This could cause issues in various record types such as `MX` records when\n    using the deprecated API. Regression introduced in 1.28.0. [Issue #757]\n  * Revert OpenBSD `SOCK_DNS` flag, it doesn't do what the docs say it does and causes c-ares to become non-functional.\n    [PR #754]\n  * `ares_getnameinfo()`: loosen validation on `salen` parameter. [Issue #752]\n  * `cmake`: Android requires C99. [PR #748]\n  * `ares_queue_wait_empty()` does not honor `timeout_ms \u003e= 0`. [Issue #742]\n- c-ares 1.28.1:\n  * Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of\n   `CARES_NO_DEPRECATED`. [PR #732]\n  * Add function `ares_search_dnsrec()` to search for records using the new DNS record data structures. [PR #719]\n  * Rework internals to pass around `ares_dns_record_t` instead of binary data, this introduces new public functions of\n    `ares_query_dnsrec()` and `ares_send_dnsrec()`. [PR #730]\n  * tests: when performing simulated queries, reduce timeouts to make tests run faster.\n  * Replace configuration file parsers with memory-safe parser. [PR #725]\n  * Remove `acountry` completely, the manpage might still get installed otherwise. [Issue #718]\n  * CMake: don't overwrite global required libraries/definitions/includes which could cause build errors for projects\n    chain building c-ares. [Issue #729]\n  * On some platforms, `netinet6/in6.h` is not included by `netinet/in.h` and needs to be included separately. [PR #728]\n  * Fix a potential memory leak in `ares_init()`. [Issue #724]\n  * Some platforms don't have the `isascii()` function. Implement as a macro. [PR #721]\n  * CMake: Fix chain building if `CMAKE` runtime paths not set.\n  * NDots configuration should allow a value of zero. [PR #735]\n","status":"published","published":"2026-08-31T19:41:34Z","modified":"2026-09-14T18:23:09.022091473Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23597-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\nUpdat to c-ares 1.36.8.\n\n- CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via `ares_getaddrinfo()`\n  over TCP (bsc#1270416).\n- CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- For details, see https://c-ares.org/changelog.html.\n","status":"published","published":"2026-09-01T15:51:00Z","modified":"2026-09-29T18:23:19.002435176Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3872-1","title":"Security update for libcares2","description":"This update for libcares2 fixes the following issues:\n\n- CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via\n  ares_getaddrinfo() over TCP (bsc#1270416).\n- CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n","status":"published","published":"2026-08-28T17:57:11Z","modified":"2026-09-10T18:23:16.250701363Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4021-1","title":"Security update for c-ares","description":"This update for c-ares fixes the following issues:\n\n- CVE-2024-25629: out of bounds read in ares__read_line() (bsc#1220279).\n- CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via\n  ares_getaddrinfo() over TCP (bsc#1270416).\n- CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).\n- CVE-2026-69186: Memory-amplification denial of service via unvalidated DNS header record counts (bsc#1276291).\n\nChanges for c-ares:\n\n- updated to 1.36.8.\n","status":"published","published":"2026-09-07T07:42:20Z","modified":"2026-09-13T18:23:16.109232489Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8844-1","title":"c-ares vulnerability","description":"It was discovered that c-ares incorrectly handled certain query completion\ncallbacks. An attacker could possibly use this issue to trigger a use-\nafter-free or double-free, resulting in a denial of service or arbitrary\ncode execution.","status":"published","published":"2026-09-29T15:15:25Z","modified":"2026-09-29T23:56:46.796447528Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}