CVE-2026-33630 is a use-after-free and double-free vulnerability in the c-ares library's query-completion handling. The flaw arises when a query callback is invoked while the query is still linked in internal lookup structures. An attacker can exploit this remotely via ares_getaddrinfo() over TCP by sending a sequence of crafted DNS responses that force an EDNS-downgrade retry followed by a TCP connection reset. This causes the internal completion handler to access freed memory, resulting in memory corruption and a crash (denial of service). The vulnerability affects all c-ares versions prior to 1.34.7 and is addressed by updating to c-ares 1.34.7 or later. Partial mitigations include using trusted DNS resolvers over trusted transports such as DNS-over-TLS and avoiding calling ares_cancel() from within query callbacks.

The vulnerability allows remote attackers to cause memory corruption leading to application crashes (denial of service) by sending specially crafted DNS responses. Depending on the allocator and build configuration, there is potential for further impact such as arbitrary code execution. The flaw is remotely exploitable without user interaction or application cooperation. No confidentiality or integrity impacts are explicitly confirmed by the vendor advisory.

A fix is available in c-ares version 1.34.7, which is included in the Red Hat Hardened Images RPM update. Users should upgrade to c-ares 1.34.7 or later to fully remediate the vulnerability. Partial mitigations include using trusted DNS resolvers accessed over trusted transports like DNS-over-TLS and avoiding calling ares_cancel() from within query callbacks. There is no complete mitigation for the remotely triggered attack path other than applying the update.