CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation

Q: What is the severity of CVE-2026-3593?

CVE-2026-3593 is considered a high severity vulnerability due to its potential to be exploited in a way that could lead to remote code execution.

Q: How do I fix CVE-2026-3593?

To fix CVE-2026-3593, upgrade to BIND 9 versions 9.20.23, 9.21.22, or later versions as specified by ISC.

Q: Which versions of BIND 9 are affected by CVE-2026-3593?

CVE-2026-3593 affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1.

Q: What type of vulnerability is CVE-2026-3593?

CVE-2026-3593 is classified as a heap use-after-free vulnerability specifically within the DNS-over-HTTPS implementation.

Q: Who is the vendor affected by CVE-2026-3593?

The vendor affected by CVE-2026-3593 is Internet Systems Consortium (ISC) which maintains BIND 9.

Published May 20, 2026

Updated

A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.

Affected Software

5 affected componentsFixes available

ISC BIND 9>=9.20.0<=9.20.22, >=9.21.0<=9.21.21, >=9.20.9-S1<=9.20.22-S1

ISC BIND>=9.20.0<9.20.23

ISC BIND>=9.21.0<9.21.22

Microsoft azl3 bind 9.20.21-1

Patch available

debian/bind9<=1:9.20.21-1~deb13u1

1:9.16.50-1~deb11u21:9.16.50-1~deb11u51:9.18.47-1~deb12u11:9.18.49-1~deb12u11:9.20.23-1~deb13u11:9.20.23-1

Remediation

Information

Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.23, 9.21.22, or 9.20.23-S1.

Patch Available

https://downloads.isc.org/isc/bind9/9.20.23

Patch Available

https://downloads.isc.org/isc/bind9/9.21.22

Event History

May 20, 2026

CVE Published

via MITRE·01:09 PM

Data Sourced

via MITRE·01:09 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

May 21, 2026

Data Sourced

via Launchpad·08:49 PM

Description

May 22, 2026

Data Sourced

via Ubuntu·08:48 PM

RemedyDescriptionSeverityAffected Software

May 23, 2026

Data Sourced

via Microsoft·08:01 AM

DescriptionSeverityWeaknessAffected Software

Updated

via Microsoft·08:01 AM

DescriptionSeverity

Data Sourced

via Debian·08:50 PM

DescriptionAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-3593?

CVE-2026-3593 is considered a high severity vulnerability due to its potential to be exploited in a way that could lead to remote code execution.

How do I fix CVE-2026-3593?

To fix CVE-2026-3593, upgrade to BIND 9 versions 9.20.23, 9.21.22, or later versions as specified by ISC.

Which versions of BIND 9 are affected by CVE-2026-3593?

CVE-2026-3593 affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1.

What type of vulnerability is CVE-2026-3593?

CVE-2026-3593 is classified as a heap use-after-free vulnerability specifically within the DNS-over-HTTPS implementation.

Who is the vendor affected by CVE-2026-3593?

The vendor affected by CVE-2026-3593 is Internet Systems Consortium (ISC) which maintains BIND 9.

CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation

Affected Software

Remediation

Information

Patch Available

Patch Available

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-3593?

How do I fix CVE-2026-3593?

Which versions of BIND 9 are affected by CVE-2026-3593?

What type of vulnerability is CVE-2026-3593?

Who is the vendor affected by CVE-2026-3593?

Company

Resources

Contact