# CVE-2026-33630: c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP CVE-2026-33630 is fixed in 26 products on 1 platform, first by FEDORA-2026-D70D93FCD7, released July 10, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-33630 - Priority: High - CVSS: 7.5 (Important) - EPSS: 0.0085 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jul 7, 2026 - Weakness: Double Free - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33630 ## Description c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | c-ares Debian 14 | 1.34.7-1 | [DEBIAN-CVE-2026-33630](https://patchblox.com/security/data/fix/linux/debian-cve-2026-33630.md) | Jul 10, 2026 | | Linux | c-ares Fedora 43 | 1.34.8-1.fc43 | [FEDORA-2026-D70D93FCD7](https://patchblox.com/security/data/fix/linux/fedora-2026-d70d93fcd7.md) | Jul 10, 2026 | | Linux | c-ares RHEL 10 | 1.34.6-2.el10_2 | [RHSA-2026:42096](https://patchblox.com/security/data/fix/linux/rhsa-2026-42096.md) | Jul 21, 2026 | | Linux | c-ares almalinux 10 | 1.34.6-2.el10_2 | [ALSA-2026:42096](https://patchblox.com/security/data/fix/linux/alsa-2026-42096.md) | Jul 20, 2026 | | Linux | c-ares ol 10 | 0:1.34.6-2.el10_2 | [ELSA-2026-42096](https://patchblox.com/security/data/fix/linux/elsa-2026-42096.md) | Jul 21, 2026 | | Linux | c-ares opensuse-leap 16.0 | 1.34.8-160000.1.1 | [OPENSUSE-SU-2026:21721-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21721-1.md) | Sep 1, 2026 | | Linux | c-ares rocky 10 | 0:1.34.6-2.el10_2 | [RLSA-2026:42096](https://patchblox.com/security/data/fix/linux/rlsa-2026-42096.md) | Jul 22, 2026 | | Linux | c-ares sles 15.6 | 1.34.8-150000.3.29.1 | [SUSE-SU-2026:4021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4021-1.md) | Sep 7, 2026 | | Linux | c-ares sles 15.7 | 1.34.8-150000.3.29.1 | [SUSE-SU-2026:4021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4021-1.md) | Sep 7, 2026 | | Linux | c-ares sles 16.0 | 1.34.8-160000.1.1 | [SUSE-SU-2026:23597-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23597-1.md) | Sep 1, 2026 | | Linux | c-ares-debuginfo Fedora 43 | 1.34.8-1.fc43 | [FEDORA-2026-D70D93FCD7](https://patchblox.com/security/data/fix/linux/fedora-2026-d70d93fcd7.md) | Jul 10, 2026 | | Linux | c-ares-debugsource Fedora 43 | 1.34.8-1.fc43 | [FEDORA-2026-D70D93FCD7](https://patchblox.com/security/data/fix/linux/fedora-2026-d70d93fcd7.md) | Jul 10, 2026 | | Linux | c-ares-devel Fedora 43 | 1.34.8-1.fc43 | [FEDORA-2026-D70D93FCD7](https://patchblox.com/security/data/fix/linux/fedora-2026-d70d93fcd7.md) | Jul 10, 2026 | | Linux | c-ares-devel almalinux 10 | 1.34.6-2.el10_2 | [ALSA-2026:42096](https://patchblox.com/security/data/fix/linux/alsa-2026-42096.md) | Jul 20, 2026 | | Linux | c-ares-devel ol 10 | 0:1.34.6-2.el10_2 | [ELSA-2026-42096](https://patchblox.com/security/data/fix/linux/elsa-2026-42096.md) | Jul 21, 2026 | | Linux | libc-ares2 Ubuntu 26.04.1 LTS (resolute) | 1.34.6-1ubuntu0.1 | [libc-ares2 1.34.6-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libc-ares2-1.34.6-1ubuntu0.1.md) | Sep 3, 2026 | | Linux | libcares2 Ubuntu 26.04.1 LTS (resolute) | 1.34.6-1ubuntu0.1 | [libcares2 1.34.6-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libcares2-1.34.6-1ubuntu0.1.md) | Sep 3, 2026 | | Linux | nodejs22 amzn 2023 | 1:22.23.1-1.amzn2023.0.2 | [ALAS2023-2026-1981](https://patchblox.com/security/data/fix/linux/alas2023-2026-1981.md) | Jul 20, 2026 | | Linux | nodejs22-debuginfo amzn 2023 | 1:22.23.1-1.amzn2023.0.2 | [ALAS2023-2026-1981](https://patchblox.com/security/data/fix/linux/alas2023-2026-1981.md) | Jul 20, 2026 | | Linux | nodejs22-debugsource amzn 2023 | 1:22.23.1-1.amzn2023.0.2 | [ALAS2023-2026-1981](https://patchblox.com/security/data/fix/linux/alas2023-2026-1981.md) | Jul 20, 2026 | | Linux | nodejs22-devel amzn 2023 | 1:22.23.1-1.amzn2023.0.2 | [ALAS2023-2026-1981](https://patchblox.com/security/data/fix/linux/alas2023-2026-1981.md) | Jul 20, 2026 | | Linux | nodejs22-docs amzn 2023 | 1:22.23.1-1.amzn2023.0.2 | [ALAS2023-2026-1981](https://patchblox.com/security/data/fix/linux/alas2023-2026-1981.md) | Jul 20, 2026 | | Linux | nodejs22-full-i18n amzn 2023 | 1:22.23.1-1.amzn2023.0.2 | [ALAS2023-2026-1981](https://patchblox.com/security/data/fix/linux/alas2023-2026-1981.md) | Jul 20, 2026 | | Linux | nodejs22-libs amzn 2023 | 1:22.23.1-1.amzn2023.0.2 | [ALAS2023-2026-1981](https://patchblox.com/security/data/fix/linux/alas2023-2026-1981.md) | Jul 20, 2026 | | Linux | nodejs22-libs-debuginfo amzn 2023 | 1:22.23.1-1.amzn2023.0.2 | [ALAS2023-2026-1981](https://patchblox.com/security/data/fix/linux/alas2023-2026-1981.md) | Jul 20, 2026 | | Linux | nodejs22-npm amzn 2023 | 1:10.9.8-1.22.23.1.1.amzn2023.0.2 | [ALAS2023-2026-1981](https://patchblox.com/security/data/fix/linux/alas2023-2026-1981.md) | Jul 20, 2026 | | Linux | nodejs24 amzn 2023 | 1:24.18.0-1.amzn2023.0.2 | [ALAS2023-2026-1980](https://patchblox.com/security/data/fix/linux/alas2023-2026-1980.md) | Jul 20, 2026 | | Linux | nodejs24-debuginfo amzn 2023 | 1:24.18.0-1.amzn2023.0.2 | [ALAS2023-2026-1980](https://patchblox.com/security/data/fix/linux/alas2023-2026-1980.md) | Jul 20, 2026 | | Linux | nodejs24-debugsource amzn 2023 | 1:24.18.0-1.amzn2023.0.2 | [ALAS2023-2026-1980](https://patchblox.com/security/data/fix/linux/alas2023-2026-1980.md) | Jul 20, 2026 | | Linux | nodejs24-devel amzn 2023 | 1:24.18.0-1.amzn2023.0.2 | [ALAS2023-2026-1980](https://patchblox.com/security/data/fix/linux/alas2023-2026-1980.md) | Jul 20, 2026 | | Linux | nodejs24-docs amzn 2023 | 1:24.18.0-1.amzn2023.0.2 | [ALAS2023-2026-1980](https://patchblox.com/security/data/fix/linux/alas2023-2026-1980.md) | Jul 20, 2026 | | Linux | nodejs24-full-i18n amzn 2023 | 1:24.18.0-1.amzn2023.0.2 | [ALAS2023-2026-1980](https://patchblox.com/security/data/fix/linux/alas2023-2026-1980.md) | Jul 20, 2026 | | Linux | nodejs24-libs amzn 2023 | 1:24.18.0-1.amzn2023.0.2 | [ALAS2023-2026-1980](https://patchblox.com/security/data/fix/linux/alas2023-2026-1980.md) | Jul 20, 2026 | | Linux | nodejs24-libs-debuginfo amzn 2023 | 1:24.18.0-1.amzn2023.0.2 | [ALAS2023-2026-1980](https://patchblox.com/security/data/fix/linux/alas2023-2026-1980.md) | Jul 20, 2026 | | Linux | nodejs24-npm amzn 2023 | 1:11.16.0-1.24.18.0.1.amzn2023.0.2 | [ALAS2023-2026-1980](https://patchblox.com/security/data/fix/linux/alas2023-2026-1980.md) | Jul 20, 2026 | | Linux | v8-12.4-devel amzn 2023 | 3:12.4.254.21-1.22.23.1.1.amzn2023.0.2 | [ALAS2023-2026-1981](https://patchblox.com/security/data/fix/linux/alas2023-2026-1981.md) | Jul 20, 2026 | | Linux | v8-13.6-devel amzn 2023 | 3:13.6.233.17-1.24.18.0.1.amzn2023.0.2 | [ALAS2023-2026-1980](https://patchblox.com/security/data/fix/linux/alas2023-2026-1980.md) | Jul 20, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.