c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.

A use-after-free and double-free vulnerability exists in the c-ares asynchronous resolver library affecting versions 1.32.3 through 1.34.6. The flaw resides in the query-completion handling logic, where a query's callback is invoked while the query remains linked in the channel's internal lookup structures. This condition is present across multiple points in the resend/finish path, including timeout handling, response handling, and query dispatch. If the query or the owning host_query (in the case of ares_getaddrinfo()) is freed as a side effect of the callback, it is subsequently accessed and/or freed a second time. This class of memory corruption vulnerability can potentially lead to crashes, arbitrary code execution, or other undefined behavior. The vulnerability has been patched in version 1.34.7, with fixes available via the official GitHub repository and release.