CVE-2025-48945

pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asynchronously. Prior to version 4.9.0, pycares is vulnerable to a use-after-free condition that occurs when a Channel object is garbage collected while DNS queries are still pending. This results in a fatal Python error and interpreter crash. The vulnerability has been fixed in pycares 4.9.0 by implementing a safe channel destruction mechanism.

• CWE-416

• https://github.com/aio-libs/aiodns/commit/f259a6e3650555157af53ac2b39f2ff545321d55
• https://github.com/aio-libs/aiodns/releases/tag/v3.5.0
• https://github.com/saghul/pycares/commit/ebfd7d71eb8e74bc1057a361ea79a5906db510d4
• https://github.com/saghul/pycares/releases/tag/v4.9.0
• https://github.com/saghul/pycares/security/advisories/GHSA-5qpg-rh4j-qp35
• https://github.com/saghul/pycares/security/advisories/GHSA-5qpg-rh4j-qp35
• https://github.com/saghul/pycares/security/advisories/GHSA-5qpg-rh4j-qp35
• https://github.com/saghul/pycares/security/advisories/GHSA-5qpg-rh4j-qp35

Published

Jun 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-4894A vulnerability classified as problematic was found in calmk…5.9
• CVE-2025-48940MyBB is free and open source forum software. Prior to versio…7.2
• CVE-2025-48941MyBB is free and open source forum software. Prior to versio…5.3
• CVE-2025-48942vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48943vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48944vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48946liboqs is a C-language cryptographic library that provides i…3.7
• CVE-2025-48947The Auth0 Next.js SDK is a library for implementing user aut…7.7
• CVE-2025-48948Navidrome is an open source web-based music collection serve…6.5
• CVE-2025-48949Navidrome is an open source web-based music collection serve…9.8
• CVE-2025-4895A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-48950MaxKB is an open-source AI assistant for enterprise. Prior t…8.8