CVE-2026-3593CWE-416CWE-825

CVE-2026-3593

High · published May 20, 2026

CVSS v3.1
7.4
EPSS
1%
Percentile
65.1
In the wild
Unconfirmed
What it is

A use-after-free vulnerability exists within the DNS-over-HTTPS implementation.

This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1.

BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01090 · 65.1th percentile
Weaknesses
CWE-416 · Use After Free; CWE-825 · Expired Pointer Dereference
Published
2026-05-20T17:16Z
Affected products (2)
ProductVersionsFixed in
isc/bind≥ 9.20.0, < 9.20.239.20.23
isc/bind≥ 9.21.0, < 9.21.229.21.22
References (7)
https://downloads.isc.org/isc/bind9/9.20.23 · [email protected]https://downloads.isc.org/isc/bind9/9.21.22 · [email protected]https://kb.isc.org/docs/cve-2026-3593 · [email protected]https://access.redhat.com/errata/RHSA-2026:7412 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-3593 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2479770 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3593.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 20 MAY 13:09Z
    Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation
    cvelistv5