CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation
A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.
Other sources
Description:
A use-after-free vulnerability exists within the DNS-over-HTTPS implementation.
Impact:
Crafted HTTP/2 traffic sent to a DNS-over-HTTPS endpoint can be used to trigger memory corruption.
- Authoritative servers are affected by this vulnerability.
- Resolvers are affected by this vulnerability.
— Red Hat
Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/bind9to a version that resolves this vulnerability.Fixed in 1:9.16.50-1~deb11u2Fixed in 1:9.16.50-1~deb11u5Fixed in 1:9.18.47-1~deb12u1Fixed in 1:9.18.49-1~deb12u1Fixed in 1:9.20.23-1~deb13u1Fixed in 1:9.20.23-1 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.23 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.21.22 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.23-S1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3593?
CVE-2026-3593 is considered a high severity vulnerability due to its potential to be exploited in a way that could lead to remote code execution.
How do I fix CVE-2026-3593?
To fix CVE-2026-3593, upgrade to BIND 9 versions 9.20.23, 9.21.22, or later versions as specified by ISC.
Which versions of BIND 9 are affected by CVE-2026-3593?
CVE-2026-3593 affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1.
What type of vulnerability is CVE-2026-3593?
CVE-2026-3593 is classified as a heap use-after-free vulnerability specifically within the DNS-over-HTTPS implementation.
Who is the vendor affected by CVE-2026-3593?
The vendor affected by CVE-2026-3593 is Internet Systems Consortium (ISC) which maintains BIND 9.