CVE-2025-48945 Overview
CVE-2025-48945 is a use-after-free vulnerability [CWE-416] in pycares, a Python module that provides bindings to the c-ares asynchronous DNS resolution C library. The flaw exists in versions prior to 4.9.0. When a Channel object is garbage collected while DNS queries remain pending, the underlying C memory is freed while Python still references it. This triggers a fatal Python error and crashes the interpreter. The downstream aiodns library inherits the same exposure and was patched in version 3.5.0.
Critical Impact
Remote attackers can induce interpreter crashes in Python applications using pycares for DNS resolution, producing denial-of-service conditions in network-facing services.
Affected Products
- pycares versions prior to 4.9.0
- aiodns versions prior to 3.5.0
- Python applications and services depending on either library for asynchronous DNS resolution
Discovery Timeline
- 2025-06-20 - CVE-2025-48945 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-48945
Vulnerability Analysis
The vulnerability resides in the lifecycle management of the pycares Channel object. The Channel wraps a native c-ares channel handle and tracks in-flight DNS queries through callback references. Python's garbage collector can destroy the Channel while c-ares still holds pointers to query state and callback objects owned by Python. When c-ares later attempts to invoke a completion callback against the freed channel, the interpreter dereferences freed memory and aborts with a fatal error.
The condition is reachable in real-world asynchronous workloads. Applications that create transient Channel instances per request, or rely on aiodns resolvers tied to short-lived event loops, can trigger the race during normal operation. Adversaries that can influence DNS resolution timing or volume against a target service can amplify the likelihood of a crash, producing a denial-of-service outcome against any service that performs DNS lookups using the affected library.
Root Cause
The root cause is missing synchronization between Python-level object destruction and the c-ares channel destruction sequence. Pycares did not enforce that all pending queries were cancelled and reaped before the channel's underlying memory was released. The fix in pycares 4.9.0 introduces a safe channel destruction mechanism that cancels outstanding queries and defers teardown until callbacks no longer reference the channel.
Attack Vector
The attack vector is network-adjacent. An attacker who can cause a vulnerable Python service to issue or abandon DNS queries at the moment a Channel is garbage collected can trigger the crash. No authentication or user interaction is required. The impact is limited to availability — the issue causes interpreter termination but does not provide code execution or data disclosure primitives.
No verified public exploit code is available. The vulnerability mechanism is documented in the pycares Security Advisory GHSA-5qpg-rh4j-qp35 and the corresponding pycares fix commit.
Detection Methods for CVE-2025-48945
Indicators of Compromise
- Sudden Python interpreter termination accompanied by a Fatal Python error message referencing pycares or c-ares callbacks.
- Repeated process restarts of services that use aiodns or pycares for DNS resolution under load.
- Core dumps or crash artifacts showing stack frames inside pycares channel callback handling.
Detection Strategies
- Inventory Python environments for pycares versions below 4.9.0 and aiodns versions below 3.5.0 using pip list or software bill of materials tooling.
- Parse application logs and systemd journal entries for abnormal interpreter exits in services performing asynchronous DNS resolution.
- Correlate service crash events with spikes in outbound DNS query volume or timeouts that may indicate exploitation attempts.
Monitoring Recommendations
- Enable process exit monitoring on hosts running Python services that depend on pycares or aiodns.
- Track restart counts for containerized workloads to identify crash-loop patterns consistent with this use-after-free.
- Alert on DNS resolver timeout bursts that correlate with worker process termination.
How to Mitigate CVE-2025-48945
Immediate Actions Required
- Upgrade pycares to version 4.9.0 or later across all Python environments.
- Upgrade aiodns to version 3.5.0 or later for applications that consume pycares indirectly.
- Rebuild and redeploy container images, virtual environments, and frozen Python applications that bundle vulnerable versions.
Patch Information
The fix is delivered in pycares 4.9.0, which implements a safe channel destruction mechanism that cancels pending queries before releasing channel memory. The aiodns project shipped the corresponding update in aiodns 3.5.0 with the aiodns fix commit.
Workarounds
- If immediate upgrade is not feasible, hold long-lived Channel or aiodns resolver instances at module or application scope to avoid garbage collection while queries are pending.
- Explicitly cancel outstanding DNS queries and wait for completion before allowing a Channel object to be released.
- Restrict untrusted network input that can influence DNS resolver workload until patched versions are deployed.
# Upgrade vulnerable Python DNS libraries
pip install --upgrade 'pycares>=4.9.0' 'aiodns>=3.5.0'
# Verify installed versions
python -c "import pycares; print(pycares.__version__)"
python -c "import aiodns; print(aiodns.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
