CVE-2026-33630

Katalog CVE

CVSS 7.5 · High EPSS 0,85%

Kerentanan Double Free. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.

Rincian

Terbit di NVD

3 September 2026

Terakhir diubah

9 September 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-415: Double Free
CWE-416: Use After Free

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 56,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc
• https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a
• https://github.com/c-ares/c-ares/pull/1237
• https://github.com/c-ares/c-ares/releases/tag/v1.34.7
• https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542