CVE-2026-3593
Fixed in a distro release EPSS 2%CVSS 7.4
A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.
Products: ISC BIND 9, Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine:v3.20 | bind | 9.18.49-r0 |
| Alpine:v3.21 | bind | 9.18.49-r0 |
| Alpine:v3.22 | bind | 9.20.23-r0 |
| Alpine:v3.23 | bind | 9.20.23-r0 |
| Alpine:v3.24 | bind | 9.20.23-r0 |
| Debian:13 | bind9 | 1:9.20.23-1~deb13u1 |
| Debian:14 | bind9 | 1:9.20.23-1 |
| Red Hat:hummingbird:1 | bind | 0:9.18.48-1.1.hum1 |
| Red Hat:hummingbird:1 | bind-chroot | 0:9.18.48-1.1.hum1 |
| Red Hat:hummingbird:1 | bind-devel | 0:9.18.48-1.1.hum1 |
| Red Hat:hummingbird:1 | bind-dnssec-utils | 0:9.18.48-1.1.hum1 |
| Red Hat:hummingbird:1 | bind-doc | 0:9.18.48-1.1.hum1 |
| Red Hat:hummingbird:1 | bind-libs | 0:9.18.48-1.1.hum1 |
| Red Hat:hummingbird:1 | bind-utils | 0:9.18.48-1.1.hum1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | bind | 9.20.23-150700.3.25.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | bind | 9.20.23-150700.3.25.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | bind | 9.18.49-150600.3.26.1 |
| SUSE:Linux Enterprise Server 16.0 | bind | 9.20.23-160000.1.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | bind | 9.18.49-150600.3.26.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | bind | 9.20.23-160000.1.1 |
| Ubuntu:22.04:LTS | bind9 | 1:9.18.39-0ubuntu0.22.04.4 |
| Ubuntu:24.04:LTS | bind9 | 1:9.18.39-0ubuntu0.24.04.5 |
| Ubuntu:25.10 | bind9 | 1:9.20.11-1ubuntu2.4 |
| Ubuntu:26.04:LTS | bind9 | 1:9.20.18-1ubuntu2.1 |
| openSUSE:Leap 16.0 | bind | 9.20.23-160000.1.1 |
| openSUSE:Tumbleweed | bind | 9.20.23-2.1 |