CVE-2026-3593 is a use-after-free flaw in the DNS-over-HTTPS code of BIND 9, scored 7.4 (High) in the CVE record. Crafted HTTP/2 traffic can trigger memory corruption. ISC fixed it in 9.20.23 and 9.21.22, and turning off DNS-over-HTTPS also avoids it.
What's affected
- Product: ISC BIND 9, authoritative servers and resolvers
- Affected versions: 9.20.0 to 9.20.22, 9.21.0 to 9.21.21, and the Supported Preview Edition 9.20.9-S1 to 9.20.22-S1
- Not affected: 9.18.0 to 9.18.48 and 9.18.11-S1 to 9.18.48-S1. ISC did not assess versions earlier than those
- Fixed versions: 9.20.23, 9.21.22 and, for the Preview Edition, 9.20.23-S1
ISC says it is not aware of any active exploits. The CVE is not in the CISA Known Exploited Vulnerabilities catalog. ISC also says configurations that do not use DNS-over-HTTPS should not be affected.
How to check if you're exposed
Check the BIND version first.
named -V | head -n 1
Then check whether DNS-over-HTTPS is configured. DoH in BIND is set up with an http listener, so search the configuration:
grep -rnE "listen-on.*(http|tls)|^\s*http " /etc/bind /etc/named* 2>/dev/null
Configuration paths differ by distribution. If the version is in the affected range and a DoH listener is defined, you are exposed. If your BIND comes from a distribution package, check the distribution advisory too. Red Hat lists erratum RHSA-2026:7412 for this CVE.
What to do now
- Upgrade to BIND 9.20.23 or 9.21.22, or to the matching distribution package.
- If you cannot upgrade yet, disable DNS-over-HTTPS. ISC lists this as an effective workaround.
- Restrict access to the DoH listener to the clients that need it.
- If you are on the 9.18 branch, you are not in the affected range. Still plan updates for other BIND advisories.
- Watch named logs for crashes or restarts, which can point to memory faults.
Why it matters
A use-after-free, CWE-416, happens when code keeps using memory after it has been released. The record also lists CWE-825, expired pointer dereference. The result can be a crash or memory corruption, and the vector shows a possible effect on confidentiality and availability, with high complexity.
DNS servers are infrastructure. When one fails, everything that depends on names fails with it. The simple comparison here is that the older 9.18 branch is outside the range, and that a feature you do not use is the cheapest thing to switch off.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect BIND 9.18?
No. ISC lists 9.18.0 to 9.18.48 as not affected.
I do not use DNS-over-HTTPS. Am I safe?
ISC says configurations not using DNS-over-HTTPS should not be affected.
Sources
Last reviewed: 19 October 2026.
