From: Volker Schlecht <openbsd-ports@schlecht.dev>
Subject: [Update] net/libcares 1.34.7
To: ports <ports@openbsd.org>, Brad <brad@comstyle.com>
Date: Mon, 6 Jul 2026 20:09:27 +0200

Fixes

Use-after-free / double-free in c-ares query-completion handling, remotely
triggerable via ares_getaddrinfo() over TCP
https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542
Index: Makefile
===================================================================
RCS file: /cvs/ports/net/libcares/Makefile,v
retrieving revision 1.41
diff -u -p -r1.41 Makefile
--- Makefile	16 Jan 2026 16:06:46 -0000	1.41
+++ Makefile	6 Jul 2026 18:05:54 -0000
@@ -1,12 +1,12 @@
 COMMENT=	asynchronous resolver library
 
-V=		1.34.6
+V=		1.34.7
 DISTNAME=	c-ares-${V}
 PKGNAME=	libcares-${V}
 CATEGORIES=	net devel
 SITES=		https://github.com/c-ares/c-ares/releases/download/v${V}/
 
-SHARED_LIBS +=  cares                4.4      # 2.19.0
+SHARED_LIBS +=  cares                4.5      # 2.19.0
 
 HOMEPAGE=	https://c-ares.org/
 
Index: distinfo
===================================================================
RCS file: /cvs/ports/net/libcares/distinfo,v
retrieving revision 1.25
diff -u -p -r1.25 distinfo
--- distinfo	16 Jan 2026 16:06:46 -0000	1.25
+++ distinfo	6 Jul 2026 18:05:54 -0000
@@ -1,2 +1,2 @@
-SHA256 (c-ares-1.34.6.tar.gz) = kS3XzDs+innFL9f7nA9Ozwqqc+Re/aiAJmotbia4TvU=
-SIZE (c-ares-1.34.6.tar.gz) = 1017864
+SHA256 (c-ares-1.34.7.tar.gz) = VW94HdGIrZMtyCY/7grTqrpnW0zY5U2GkIaBtDzj4yc=
+SIZE (c-ares-1.34.7.tar.gz) = 1034872