CVE-2026-33630

c-ares, a widely used asynchronous DNS resolver library, contains a use-after-free/double-free (CWE-415/CWE-416) in versions 1.32.3 through before 1.34.7, where a query's callback is invoked while the query is still linked in the channel's internal lookup structures. The flaw is reachable at multiple points in the resend/finish path — timeout handling, response handling, and query dispatch — and if the callback frees the query (or, for ares_getaddrinfo(), the owning host_query), the freed object is then accessed and/or freed a second time. An attacker who can influence DNS query completion, for example via spoofed, delayed, or malformed DNS responses on a network path the application resolves against, can crash the process, resulting in denial of service (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N with high availability impact). Any application, runtime, or distribution package that bundles or links the affected c-ares versions is affected, including consumers such as Node.js, gRPC, and curl builds that use the c-ares resolver. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.5% probability of exploitation within 30 days.

What to do: Upgrade c-ares to 1.34.7 or later, and verify the c-ares version embedded or linked by downstream applications and runtimes (Node.js, gRPC, curl) as well as distribution packages, since patching the standalone library alone does not fix statically linked consumers. If upgrading is not immediately possible, prioritize hosts where untrusted DNS responses can reach the process and apply vendor/package updates as they become available. Monitor advisories from applications that bundle c-ares for rebuilt releases containing the fixed version.