UnratedPyPIAmendedPublished
pycares has a Use-After-Free Vulnerability
CVE-2025-48945 · GHSA-5qpg-rh4j-qp35
- Affected
- PyPI pycares <= 4.8.0
- Fixed in
- 4.9.0· Vendor fix available
- Issue
- pycares is vulnerable to a use-after-free condition that occurs when a Channel object is garbage collected while DNS queries are still pending. This results in a fatal Python error and interpreter crash. Details Root Cause The vulnerability stems from improper handling of callback references when the Channel object is destroyed: 1. When a DNS query is initiated, pycares stores a callback reference using ffi.newhandle() 2. If the Channel object is garbage collected while queries are pending, the callback references become invalid 3. When c-ares attempts to invoke the callback, it accesses freed memory, causing a fatal error This issue was much more likely to occur when using eventthread=True but could happen without it under the right circumstances. Technical Details The core issue is a race condition between Python's garbage collector and c-ares's callback execution: 1. When del is called from within a c-ares callback context, we cannot immediately call aresdestroy() because…
Recommended action: Upgrade to 4.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.