Описание
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.
A flaw was found in c-ares. A use-after-free / double-free vulnerability exists in the query-completion handling path, where a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafted DNS responses that force an EDNS-downgrade retry followed by a connection reset, causing the internal completion handler to access freed memory. This leads to memory corruption and a crash (denial of service), with potential for further impact depending on the allocator and build configuration.
Отчет
A use-after-free / double-free vulnerability was found in c-ares' query-completion handling. The flaw is remotely exploitable without application cooperation via ares_getaddrinfo() over TCP: a malicious or on-path DNS server can force a specific sequence of responses (FORMERR without OPT record, duplicate query ID response, TCP reset) that causes the internal completion handler to access freed memory. An attacker can force the client onto TCP by setting the truncation (TC) bit in a UDP response. The consequence is memory corruption leading to a crash (denial of service). This is a broader fix for the pattern previously addressed in CVE-2025-31498. All versions of c-ares prior to 1.34.7 are affected.
Меры по смягчению последствий
There is no complete mitigation for the remotely-triggered path. As a partial mitigation, use trusted DNS resolvers reached over a trusted transport (e.g., DNS-over-TLS). Avoid calling ares_cancel() from within a query callback to prevent the application-triggered path. Upgrade to c-ares 1.34.7 or later.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | c-ares | Out of support scope | ||
| Red Hat Enterprise Linux 7 | c-ares | Not affected | ||
| Red Hat Enterprise Linux 8 | c-ares | Not affected | ||
| Red Hat Enterprise Linux 9 | c-ares | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected | ||
| Red Hat OpenShift Container Platform 5 | openshift/ose-rhel-coreos-9 | Not affected | ||
| Red Hat Enterprise Linux 10 | c-ares | Fixed | RHSA-2026:42096 | 20.07.2026 |
| Red Hat Hardened Images | c-ares-main-1.34.7-1.hum1 | Fixed | RHSA-2026:36192 | 07.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.
c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34 ...
EPSS
7.5 High
CVSS3