Description

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T19:17:27.420Z",
  "pubdate": "2026-09-03T19:17:27.420Z",
  "executiveSummary": "The c-ares asynchronous resolver library is affected by a critical memory management vulnerability involving use-after-free and double-free conditions.\nThe vulnerability stems from improper query-completion handling where callbacks are executed while the query object remains linked in internal lookup structures.\nAffected versions include 1.32.3 through 1.34.7. If a callback triggers the deallocation of the query (or the host_query structure in ares_getaddrinfo), subsequent operations attempt to access or free the same memory, leading to memory corruption.\nThis flaw presents significant risk, as it can potentially be leveraged for arbitrary code execution, denial of service, or unauthorized memory information disclosure, depending on the heap layout and application state.\nExploitation requires the victim application to process specific DNS resolution responses or timeout conditions that trigger the vulnerable code path while a callback is active.\nThe vulnerability is fixed in version 1.34.7; upgrading is the primary security requirement to eliminate the risk of heap-based memory corruption.",
  "technicalDetails": "The vulnerability is rooted in an object lifecycle management flaw within the c-ares asynchronous query completion logic. Specifically, the library permits a race-like condition where a query's completion callback is invoked while the query object itself is still referenced by the channel's internal linked lists or lookup trees.\nThe flaw manifests across multiple critical code paths within the library, including response processing, timeout handling, and query dispatch mechanisms. In a standard operation, a query is tracked within the c-ares state machine; when a response is received or a timeout occurs, the library invokes a user-provided callback.\nIf the logic within that callback (or an associated deallocation routine) explicitly or implicitly frees the memory associated with the query structure or the parent host_query structure (in the case of ares_getaddrinfo), the memory is released to the allocator.\nBecause the c-ares internal state still holds a pointer to this now-freed memory, the subsequent logic within the library attempts to interact with the query structure again—often to unlink it from internal queues or perform post-processing cleanup. This results in a use-after-free scenario. If the allocator has reallocated that specific memory block for another object, the library will inadvertently operate on invalid data or, if the memory is freed again by the state machine logic, a double-free occurs.\nThe attack flow requires the attacker to influence the DNS resolution process—potentially through man-in-the-middle positioning or by providing crafted DNS responses—to force a query into a state where the callback is triggered under conditions that lead to premature object destruction.\nOnce the use-after-free occurs, the attacker may gain control over the instruction pointer or the heap's metadata, depending on how the application uses the library and the underlying glibc or system heap allocator. By controlling the contents of the reallocated memory, an attacker might achieve arbitrary code execution by redirecting execution flow via overwritten function pointers or vtables within the affected memory block.\nThis issue affects all versions from 1.32.3 up to 1.34.7, across any system utilizing c-ares for asynchronous DNS resolution. No specific authentication is required to trigger this vulnerability, as the memory corruption is triggered during standard asynchronous networking tasks. The severity is exacerbated by the fact that many security-sensitive applications rely on c-ares for name resolution, making the heap corruption exploitable in a variety of high-privilege network contexts."
}