Skip to main content

BIND 9 CVE-2026-3593

| EUVDEUVD-2026-31108 CRITICAL
Use After Free (CWE-416)
2026-05-20 isc GHSA-8v2c-7qqj-7wp7
Information Disclosure Use After Free Memory Corruption Bind 9 Isc
9.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach DoH HTTPS endpoint
  2. Delivery
    Send crafted DoH request sequence
  3. Exploit
    Trigger use-after-free in named
  4. Execution
    Reuse freed heap object
  5. Impact
    Crash service or leak heap memory

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target BIND 9 server have the DNS-over-HTTPS (DoH) transport enabled and reachable - i.e., a 'https' listener configured in named.conf; servers running only classic UDP/TCP DNS, DoT, or with DoH disabled are not exposed through this path. The affected build must be in the vulnerable ranges (9.20.0-9.20.22, 9.21.0-9.21.21, or 9.20.9-S1-9.20.22-S1); the entire 9.18.x branch is unaffected, so installations on 9.18 are inherently safe. Per CVSS the action is unauthenticated and needs no user interaction (PR:N/UI:N), so the primary limiting factor is the non-default requirement that DoH be turned on and network-accessible to the attacker.
Impact

The signals here conflict and must be weighed rather than taken at face value. The vendor CVSS of 9.8 with full C:H/I:H/A:H assumes worst-case impact, but CISA's SSVC framework classifies technical impact as 'partial' (not total), automatable as 'no', and exploitation as 'none' - a markedly more conservative read consistent with a UAF that most plausibly yields a crash or limited memory disclosure rather than reliable remote code execution. EPSS reinforces the lower-urgency view at just 0.02% (7th percentile), and the CVE is not on CISA KEV, so there is no evidence of active exploitation. The realistic exposure is also gated by configuration: only servers with DoH enabled are reachable, which is far from a universal BIND deployment choice. Net assessment: this is a genuine memory-safety bug in a ubiquitous product and should be patched on a normal-priority cadence, but the headline 9.8 overstates near-term real-world risk - treat the impact as likely DoS/info-leak (verify intended impact with the ISC advisory) rather than confirmed RCE.
Exploit ScenarioDerived

An attacker who can reach a BIND 9 resolver that has DoH enabled sends specially sequenced DoH requests to the HTTPS endpoint to drive the named process into freeing and then reusing a connection/query object, corrupting heap memory. The most likely outcome is a crash of named (denial of service) or disclosure of fragments of adjacent heap memory; no public proof-of-concept is identified at time of analysis, and the CVSS AV:N/AC:L profile means no authentication or user interaction is required once the DoH service is exposed.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 30, 2026

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CWE-416) by interacting with the DoH endpoint, affecting BIND 9.20.0-9.20.22, 9.21.0-9.21.21, and the 9.20.9-S1-9.20.22-S1 subscription builds; the older 9.18.x branch is explicitly not affected. The vendor scores it CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), implying unauthenticated remote impact, though CISA's SSVC rates technical impact as only 'partial' and exploitation as 'none'. There is no public exploit identified at time of analysis and EPSS is very low (0.02%, 7th percentile), indicating no observed exploitation activity.

Earlier versions of this analysis (2)
v2 Jun 30, 2026 - 03:31 cvss changed CVSS 9.8

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation allows remote attackers to trigger a use-after-free condition, affecting BIND 9.20.0–9.20.22, 9.21.0–9.21.21, and the 9.20.9-S1–9.20.22-S1 subscription branch. The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, but signals conflict sharply: EPSS is only 0.02% (7th percentile), CISA SSVC rates exploitation as 'none' and technical impact as 'partial', and no public exploit is identified at time of analysis. A vendor patch is available.

v1 May 20, 2026 - 13:31 CVSS 7.4

Use-after-free in the DNS-over-HTTPS (DoH) implementation of ISC BIND 9 (9.20.0-9.20.22, 9.21.0-9.21.21, and Subscription Edition 9.20.9-S1-9.20.22-S1) allows remote attackers to corrupt freed memory in the resolver/server process, potentially causing denial of service and possible information disclosure. The 9.18.x branch (including 9.18.11-S1 through 9.18.48-S1) is explicitly unaffected. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

RemediationAI

Vendor-released patch: upgrade to BIND 9.20.23 (https://downloads.isc.org/isc/bind9/9.20.23) for the 9.20 branch or 9.21.22 (https://downloads.isc.org/isc/bind9/9.21.22) for the 9.21 branch; subscription users on 9.20.x-S1 should obtain the corresponding fixed -S build from ISC support. If you run distribution packages, apply the vendor errata instead - Ubuntu USN-8293-1 (https://ubuntu.com/security/notices/USN-8293-1) or Red Hat RHSA-2026:7412 (https://access.redhat.com/errata/RHSA-2026:7412). As an immediate compensating control where patching must wait, disable the DoH listener by removing the 'https' (DoH) entries from the listen-on/listen-on-v6 statements in named.conf, which fully closes the attack surface at the cost of losing encrypted DoH service to clients; alternatively, if DoH must remain available, restrict reachability of the DoH TCP port (typically 443/853 as configured) with a firewall so only trusted resolvers/clients can connect, accepting that this does not protect against authorized-but-malicious clients. See the ISC advisory at https://kb.isc.org/docs/cve-2026-3593 for definitive guidance.

Affected VersionsENISA

BIND 9 9.20.0 ≤9.20.22
BIND 9 9.20.9-S1 ≤9.20.22-S1
BIND 9 9.21.0 ≤9.21.21

Affected Packages

euvd bind_9 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

BIND 9 is the Internet Systems Consortium's reference DNS server, and this flaw lives specifically in its DNS-over-HTTPS (DoH, RFC 8484) transport, where DNS queries are tunneled over HTTP/2 inside TLS. The root cause is CWE-416 (use-after-free): an object backing a DoH connection or query is freed while a pointer to it is still in use, so a subsequent dereference operates on reclaimed heap memory. Depending on heap state this can crash named (denial of service) or, as the 'Information Disclosure' and 'Memory Corruption' tags suggest, leak adjacent heap contents; full code execution is theoretically possible with UAF classes but is not demonstrated here. The single CPE provided, cpe:2.3:a:isc:bind_9:*, confirms the affected component is the BIND 9 nameserver itself rather than client tooling, and exploitation is only reachable when the DoH listener is actually enabled in named.conf.

Know when Bind 9 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 8.2 HIGH

DoH endpoint is remote and unauthenticated (AV:N/PR:N), but a UAF most plausibly yields a crash (A:H) with limited heap disclosure (C:L) rather than confirmed integrity/code-execution impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat 7.4 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Updated
Jun 30, 2026 - 03:32 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 03:31 vuln.today
v2 - CVSS changed
Severity Changed
Jun 30, 2026 - 03:24 NVD
HIGH CRITICAL
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.4 (HIGH) 9.8 (CRITICAL)

DescriptionNVD

A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.

Executive ViewAI

Why It Matters

ISC BIND 9 versions 9.20.0-9.20.22 and 9.21.0-9.21.21 contain a critical memory corruption flaw in the DNS-over-HTTPS module that permits unauthenticated remote attackers to disrupt DNS service availability or potentially achieve unauthorized system access. Organizations operating these BIND versions face immediate exposure, as the vulnerability requires no authentication or user interaction to exploit. DNS infrastructure failure cascades across all dependent systems, making this a priority remediation target.

Business Impact: Severe
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Prevalence
Ubiquitous
BIND 9 is the most widely deployed DNS server software worldwide
Social Media
4
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Very High
Technical Impact
Partial

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Bind 9

View all
CVE-2026-1519 HIGH POC
7.5 Mar 25

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
CVE-2026-3104 HIGH POC
7.5 Mar 25

Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
CVE-2026-13321 HIGH
8.6 Jul 22

DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling

CVE-2026-94300 HIGH
8.1 Oct 21

Memory corruption in ISC BIND 9's GSS-TSIG handling allows an on-path attacker who captures a previously signed UDP mess
CVE-2026-11622 HIGH
7.5 Jul 22

Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
CVE-2026-13204 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
CVE-2026-11605 HIGH
7.5 Jul 22

Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
CVE-2026-11721 HIGH
7.5 Jul 22

Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
CVE-2026-11331 HIGH
7.5 Jul 22

RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
CVE-2026-12617 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
CVE-2026-80274 HIGH
7.5 Sep 16

Denial of service in ISC BIND 9 recursive resolvers affects versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.2
CVE-2026-19667 HIGH
7.5 Sep 16

Remote denial of service in ISC BIND 9 lets an attacker-controlled (or spoofing-capable) authoritative DNS server crash

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

References

Advisories & patches
PATCH https://downloads.isc.org/isc/bind9/9.20.23 PATCH https://downloads.isc.org/isc/bind9/9.21.22 ADVISORY https://access.redhat.com/errata/RHSA-2026:7412 ADVISORY https://kb.isc.org/docs/cve-2026-3593 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-3593 ADVISORY https://ubuntu.com/security/notices/USN-8293-1 ADVISORY https://vuldb.com/vuln/364873 REF https://access.redhat.com/security/cve/CVE-2026-3593 REF https://bugzilla.redhat.com/show_bug.cgi?id=2479770 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3593.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy