Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33630: A use-after-free / double-free in c-ares' query-completion handling. The same flaw -- a query's callback being invoked while the query is still linked in the channel's internal lookup structures -- is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for `ares_getaddrinfo()` the owning `host_query`, is freed as a side effect of that callback, it is then accessed and/or freed a second time.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | nodejs24 | 1:24.18.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs24-debuginfo | 1:24.18.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs24-debugsource | 1:24.18.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs24-devel | 1:24.18.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs24-docs | 1:24.18.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs24-full-i18n | 1:24.18.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs24-libs | 1:24.18.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs24-libs-debuginfo | 1:24.18.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs24-npm | 1:11.16.0-1.24.18.0.1.amzn2023.0.2 |
| Amazon Linux · 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.amzn2023.0.2 |
Vulnerabilities 1
-
High 7.5
c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup st…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-33630.html