Introduction
A heap use after free in BIND 9's DNS over HTTPS implementation lets a remote, unauthenticated attacker crash the named process by flooding HTTP/2 SETTINGS frames while the server writes a DoH response. BIND 9 is the most widely deployed DNS server software on the Internet, so this vulnerability (CVE-2026-3593, CVSS 7.4) matters to any organization that has enabled DoH on its authoritative or recursive DNS infrastructure.
Technical Information
CVE-2026-3593 is classified as CWE-416 (Use After Free) and affects the DNS over HTTPS code path in BIND 9. The root cause is a race condition in how the server handles incoming HTTP/2 SETTINGS frames while it is writing DoH responses.
Root Cause
If a DNS over HTTPS client sends a flood of HTTP/2 SETTINGS frames at the exact moment the BIND 9 server is writing a DoH response, a heap memory region is freed too early. The response-writing logic then accesses that freed memory, which is the use-after-free condition. The named process crashes, and DNS service is denied. Because the corruption occurs on the heap, there is also a theoretical risk that sensitive data in adjacent memory could be exposed.
Attack Flow
- The attacker identifies a BIND 9 instance with DNS over HTTPS enabled and reachable over the network.
- The attacker establishes an HTTP/2 connection to the DoH endpoint.
- The attacker issues a DNS query over HTTPS so that the server begins writing a response.
- While the server is writing the DoH response, the attacker sends a rapid flood of HTTP/2 SETTINGS frames over the same connection.
- The timing collision between SETTINGS frame processing and response writing triggers the use-after-free condition.
- The
namedprocess crashes, and DNS service stops.
CVSS Breakdown
| Metric | Value | Description |
|---|---|---|
| Attack Vector | Network | Exploitable remotely over the network |
| Attack Complexity | High | Requires specific timing during response writing |
| Privileges Required | None | No authentication needed to send HTTP/2 frames |
| User Interaction | None | Exploitation occurs without user involvement |
| Confidentiality Impact | High | Memory corruption could expose sensitive data |
| Availability Impact | High | Can cause the named process to crash |
The High attack complexity rating reflects the narrow timing window an attacker has to hit. Still, no authentication is required, and the impact on both confidentiality and availability is severe, so exposed DoH endpoints face a meaningful risk.
Important Scope Limitation
Only BIND 9 instances with DNS over HTTPS enabled are vulnerable. Configurations that do not use DoH are entirely unaffected.
Affected Systems and Versions
The following BIND 9 versions are affected:
| Branch | Affected Versions | Fixed Version |
|---|---|---|
| BIND 9.20 (Stable) | 9.20.0 through 9.20.22 | 9.20.23 |
| BIND 9.21 (Development) | 9.21.0 through 9.21.21 | 9.21.22 |
| Supported Preview Edition | 9.20.9 S1 through 9.20.22 S1 | 9.20.23 S1 |
The following versions are explicitly not affected:
| Branch | Unaffected Versions |
|---|---|
| BIND 9.18 (Stable) | 9.18.0 through 9.18.48 |
| Supported Preview Edition (9.18) | 9.18.11 S1 through 9.18.48 S1 |
A system is vulnerable only if DNS over HTTPS is enabled. Systems running affected versions without DoH configured are not at risk.
Vendor Security History
ISC has maintained BIND 9 as critical open-source infrastructure for a long time, and it has consistently published timely security advisories and patches for high-severity vulnerabilities across BIND 9's lifecycle. SecurityWeek has previously reported on BIND updates that patched high-severity vulnerabilities, part of ISC's ongoing attention to the security of its software. Naresh Kandula Parmar discovered CVE-2026-3593 and reported it to ISC through ISC's vulnerability disclosure process.
