c-ares CVE-2026-33630

c-ares (cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:*) is an asynchronous, non-blocking DNS resolver library embedded in Node.js, curl/libcurl, and a large number of other networked applications. CWE-415 (Double Free) describes the root cause: in ares_process.c, the query completion path (read_answers, process_timeouts, and ares_send_query) invoked query->callback() while the query object was still registered in both all_queries and queries_by_qid hash structures. If the application's callback triggered a reentrant ares_cancel() - a documented, legal API call - the library would locate the still-linked query and free it, leaving a dangling pointer; upon return from the callback, the library's own cleanup code would then access and free the already-released memory. The fix introduces ares_detach_query() to atomically remove the query from all lookup structures before invoking the callback, and replaces the recursive retry dispatch loop with an iterative ares_flush_requeue() drain, closing the double-free across all three code paths simultaneously.