by Kastro
Paper/Archive/CVE-2026-3593

CVE-2026-3593

ISC BIND 9 — Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation

EPSS 2%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.9.749 × 2015.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.

Affected

ProductAffectedFixed inSource
BIND 99.20.0 – 9.20.229.18.0CNA
BIND 99.21.0 – 9.21.219.18.0CNA
BIND 99.20.9-S1 – 9.20.22-S19.18.0CNA
Red Hat Hardened Imagessee advisory9.18.48-1.1.hum1redhat-SADP
Red Hat Enterprise Linux 10see advisory–redhat-SADP
Red Hat Enterprise Linux 6see advisory–redhat-SADP
Red Hat Enterprise Linux 7see advisory–redhat-SADP
Red Hat Enterprise Linux 8see advisory–redhat-SADP
Red Hat Enterprise Linux 8see advisory–redhat-SADP
Red Hat Enterprise Linux 9see advisory–redhat-SADP
Red Hat Enterprise Linux 9see advisory–redhat-SADP
Red Hat Enterprise Linux 9see advisory–redhat-SADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
isc (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
redhat-SADP (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorykb.isc.org/docs/cve-2026-3593patchdownloads.isc.org/isc/bind9/9.20.23patchdownloads.isc.org/isc/bind9/9.21.22refaccess.redhat.com/security/cve/CVE-2026-3593refbugzilla.redhat.com/show_bug.cgi?id=2479770refsecurity.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3593.jsonadvisoryaccess.redhat.com/errata/RHSA-2026:7412