CVE-2026-3593

EUVD-2026-31108
A use-after-free vulnerability exists within the DNS-over-HTTPS implementation.
This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1.
BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 72.76%
Affected Products (NVD)
VendorProductVersion
iscbind
9.20.0 ≤
𝑥
< 9.20.23
iscbind
9.21.0 ≤
𝑥
< 9.21.22
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Hardened Images
9.18.48-1.1.hum1 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
bind9
bookworm
1:9.18.49-1~deb12u1
fixed
bookworm (security)
1:9.18.49-1~deb12u2
fixed
bullseye
1:9.16.50-1~deb11u2
fixed
bullseye (security)
1:9.16.50-1~deb11u6
fixed
forky
1:9.20.26-1
fixed
sid
1:9.20.26-1
fixed
trixie
1:9.20.23-1~deb13u1
fixed
trixie (security)
1:9.20.26-1~deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
bind9-libs
focal
not-affected
jammy
not-affected
noble
dne
questing
dne
resolute
dne
bind9
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
questing
Fixed 1:9.20.11-1ubuntu2.4
released
resolute
Fixed 1:9.20.18-1ubuntu2.1
released
trusty
not-affected
xenial
not-affected
isc-dhcp
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
questing
not-affected
resolute
not-affected
trusty
not-affected
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
bind
suse enterprise sap 15 SP7
9.20.23-150700.3.25.1
fixed
suse enterprise server 15 SP6
9.18.49-150600.3.26.1
fixed
suse enterprise server 15 SP7
9.20.23-150700.3.25.1
fixed
bind-doc
suse enterprise sap 15 SP7
9.20.23-150700.3.25.1
fixed
suse enterprise server 15 SP6
9.18.49-150600.3.26.1
fixed
suse enterprise server 15 SP7
9.20.23-150700.3.25.1
fixed
bind-utils
suse enterprise server 15 SP6
9.18.49-150600.3.26.1
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
bind
Azure Linux 3.0
0:9.20.23-1.azl3
fixed
Common Weakness Enumeration
References
https://downloads.isc.org/isc/bind9/9.20.23
https://downloads.isc.org/isc/bind9/9.21.22
https://kb.isc.org/docs/cve-2026-3593
https://access.redhat.com/errata/RHSA-2026:7412
https://access.redhat.com/security/cve/CVE-2026-3593
https://bugzilla.redhat.com/show_bug.cgi?id=2479770
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3593.json