c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade c-ares | Sep 7, 2026 | Sep 3, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-npmUpgrade nodejs24-develUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-npmUpgrade nodejs22-libsUpgrade nodejs22-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs22-develUpgrade nodejs24-libsUpgrade nodejs22Upgrade nodejs24-full-i18nUpgrade nodejs24Upgrade v8-12.4-develUpgrade nodejs22-docsUpgrade nodejs22-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-docsUpgrade nodejs22-debuginfoUpgrade v8-13.6-devel | Sep 7, 2026 | Sep 3, 2026 |
| Redhat_linux | — | Upgrade c-aresUpgrade c-ares-debuginfoUpgrade c-ares-develUpgrade c-ares-debugsourceNo solution exists | Jul 17, 2026 | Jul 7, 2026 |
| Rocky_linux | — | Upgrade c-ares-debuginfoUpgrade c-ares-debugsourceUpgrade c-aresUpgrade c-ares-devel | Jul 27, 2026 | Jul 22, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub