CVE-2025-48945
pycares has a Use-After-Free Vulnerability
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
pycares has a Use-After-Free Vulnerability
pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asynchronously. Prior to version 4.9.0, pycares is vulnerable to a use-after-free condition that occurs when a Channel object is garbage collected while DNS queries are still pending. This results in a fatal Python error and interpreter crash. The vulnerability has been fixed in pycares 4.9.0 by implementing a safe channel destruction mechanism.
Reserved 2025-05-28 | Published 2025-06-20 | Updated 2025-06-20 | Assigner GitHub_Mgithub.com/...ycares/security/advisories/GHSA-5qpg-rh4j-qp35
github.com/...ycares/security/advisories/GHSA-5qpg-rh4j-qp35
github.com/...ommit/f259a6e3650555157af53ac2b39f2ff545321d55
github.com/...ommit/ebfd7d71eb8e74bc1057a361ea79a5906db510d4
github.com/aio-libs/aiodns/releases/tag/v3.5.0
github.com/saghul/pycares/releases/tag/v4.9.0
Support options
