Threats affecting pkg:pypi/pycares

CVE-2025-48945 is a use-after-free vulnerability in the pycares library (part of aio-libs aiodns) that occurs when a Channel object is garbage collected while DNS queries are still pending. This leads to a fatal Python interpreter crash due to invalid callback references. The issue arises from a race condition between Python's garbage collector and c-ares callback execution. The vulnerability is fixed in pycares version 4.9.0 with a safe channel destruction mechanism.