Loading vulnerability…
CVE-2026-33630 is a remotely triggerable memory-safety flaw in c-ares query-completion handling affecting the ares_getaddrinfo() resolution path over TCP. The vulnerability arises because a query callback can be invoked while the query remains linked in internal lookup structures. If the callback path, or subsequent protocol-driven processing, causes the associated query or owning host_query object to be freed, c-ares may later re-enter completion logic and access or free the same object again, resulting in a use-after-free or double-free condition. The issue can be triggered through application re-entry from a callback, such as cancellation during callback execution, and also through a fully remote path requiring no application cooperation. In the remote scenario, a malicious or on-path DNS server can manipulate response sequencing so that deferred retries and completions are re-entered against already-freed state, including by forcing fallback to TCP and then delivering crafted responses that drive the vulnerable completion flow. The flaw was reported as reproducible against c-ares 1.34.6 and the development branch, and was fixed in c-ares 1.34.7 by detaching each query from lookup structures before invoking callbacks and routing deferred retries and completions through a single iterative drain path.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
ares_getaddrinfo() over-TCP path, an attacker can disrupt applications that rely on c-ares for name resolution without requiring local code execution or user interaction. Reliable arbitrary code execution has not been demonstrated based on the available information.If you can’t patch tonight, do this now.
ares_cancel() or similar re-entrant operations inside a query callback is only a partial mitigation and does not address the fully remote trigger path driven entirely by malicious DNS responses. Where operationally feasible, reducing exposure to untrusted or attacker-influenced DNS infrastructure may lower risk, but this does not eliminate the vulnerability.Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.