Double Free in C-Ares

CVE-2026-33630

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.

Vulnerability class: Double Free

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.008 (57.2th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 57th percentile — 57.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-33630: held from 0.005 to 0.008.

EPSS over last 30 days · oldest: 0.005 · newest: 0.008 · change: +0.004

Affected products

  • C-Ares — versions >= 1.32.3, < 1.34.7

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-33630?
CVE-2026-33630 is a high-severity vulnerability in C-Ares, classified under Double Free. CVSS score: 7.5/10. Published 2026-09-03.
How severe is CVE-2026-33630?
High severity. CVSS v3 base score is 7.5 out of 10.