Most recent entries from all

BREW-checkov-CVE-2025-48945 — pycares has a Use-After-Free Vulnerability

Affected: Homebrew: checkov

## Summary

pycares is vulnerable to a use-after-free condition that occurs when a Channel object is garbage collected while DNS queries are still pending. This results in a fatal Python error and interpreter crash.

## Details

### Root Cause

The vulnerability stems from improper handling of callback references when the Channel object is destroyed:

1. When a DNS query is initiated, pycares stores a callback reference using `ffi.new_handle()` 2. If the Channel object is garbage collected while queries are pending, the callback references become invalid 3. When c-ares attempts to invoke the callback, it accesses freed memory, causing a fatal error

This issue was much more likely to occur when using `event_thread=True` but could happen without it under the right circumstances.

### Technical Details

The core issue is a race condition between Python's garbage collector and c-ares's callback execution:

1. When `__del__` is called from within a c-ares callback context, we cannot immediately call `ares_destroy()` because c-ares is still executing code after the callback returns 2. c-ares needs to execute cleanup code after our Python callback returns (specifically at lines 1422-1429 in ares_process.c) 3. If we destroy the channel too quickly, c-ares accesses freed memory

### Impact

Applications using `pycares` can be crashed remotely by triggering DNS queries that result in `Channel` objects being garbage collected before query completion. This is particularly problematic i…

EUVD-2026-245454

fkie_cve-2025-48945

pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asynchronously. Prior to version 4.9.0, pycares is vulnerable to a use-after-free condition that occurs when a Channel object is garbage collected while DNS queries are still pending. This results in a fatal Python error and interpreter crash. The vulnerability has been fixed in pycares 4.9.0 by implementing a safe channel destruction mechanism.

GHSA-5qpg-rh4j-qp35 — pycares has a Use-After-Free Vulnerability

Affected: PyPI: pycares

## Summary

## Details

### Root Cause

The vulnerability stems from improper handling of callback references when the Channel object is destroyed:

This issue was much more likely to occur when using `event_thread=True` but could happen without it under the right circumstances.

### Technical Details

The core issue is a race condition between Python's garbage collector and c-ares's callback execution:

### Impact

Applications using `pycares` can be crashed remotely by triggering DNS queries that result in `Channel` objects being garbage collected before query completion. This is particularly problematic i…

OESA-2025-1810 — python-pycares security update

Affected: openEuler:24.03-LTS-SP1: python-pycares

pycares is a Python module which provides an interface to c-ares.c-ares is a C library that performs DNS requests and name resolutions asynchronously. Security Fix(es):

openSUSE-SU-2025:15324-1 — python311-pycares-4.9.0-1.1 on GA media

python311-pycares-4.9.0-1.1 on GA media

UBUNTU-CVE-2025-48945

Affected: Ubuntu:18.04:LTS: pycares, Ubuntu:20.04:LTS: pycares, Ubuntu:22.04:LTS: pycares, Ubuntu:24.04:LTS: pycares, Ubuntu:25.10: pycares, Ubuntu:26.10: pycares, Ubuntu:26.04:LTS: pycares