Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33630: A use-after-free / double-free in c-ares' query-completion handling. The same flaw -- a query's callback being invoked while the query is still linked in the channel's internal lookup structures -- is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for `ares_getaddrinfo()` the owning `host_query`, is freed as a side effect of that callback, it is then accessed and/or freed a second time.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | nodejs22 | 1:22.23.1-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-debuginfo | 1:22.23.1-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-debugsource | 1:22.23.1-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-devel | 1:22.23.1-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-docs | 1:22.23.1-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-full-i18n | 1:22.23.1-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-libs | 1:22.23.1-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-libs-debuginfo | 1:22.23.1-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-npm | 1:10.9.8-1.22.23.1.1.amzn2023.0.2 |
| Amazon Linux · 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.1.amzn2023.0.2 |
Vulnerabilities 1
-
High 7.5
c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup st…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-33630.html