cve-2026-3593

CVE-2026-3593 is a high-severity heap use-after-free vulnerability in the DNS-over-HTTPS (DoH) implementation of BIND 9, disclosed on May 20, 2026. It affects BIND 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and supported preview versions 9.20.9-S1 through 9.20.22-S1. Crafted HTTP/2 traffic sent to a DoH endpoint can trigger memory corruption, impacting both authoritative servers and resolvers when DoH is enabled. The immediate fix is to upgrade to BIND 9.20.23, 9.21.22, or 9.20.23-S1. For operators unable to patch immediately, disabling DoH is the recommended workaround. This tag covers discussions about the vulnerability, patching guidance, and mitigation strategies for Windows systems running BIND 9 with DoH.