Loading story…
ISC disclosed CVE-2026-3593, a heap use-after-free flaw in BIND 9's DNS-over-HTTPS implementation that can be triggered remotely without authentication by flooding a DoH endpoint with crafted HTTP/2 SETTINGS frames while a response is being written. The bug occurs in server_read_callback, where data is read from socket->h2->wbuf after the associated ns_client_t memory has already been freed through http_writecb and isc_nmhandle_detach, creating a race condition in affected DoH deployments.
Successful exploitation can crash the named process and cause denial of service, and ISC's issue report says freed heap data may also be copied into HTTP/2 response data and returned to the attacker over TLS, creating an information disclosure risk. The vulnerability affects BIND 9 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and Supported Preview Edition 9.20.9 S1 through 9.20.22 S1 when DoH is enabled; non-DoH configurations are not affected. Fixes are available in 9.20.23, 9.21.22, and 9.20.23 S1, and the issue is tracked as CWE-416 with a CVSS 7.4 score after an earlier code-execution claim was withdrawn.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The ISC GitLab reference explicitly states the vulnerability was publicly disclosed on 2026-05-20. ZeroPath also reports affected versions and available fixed releases for BIND 9 DoH deployments.
ZeroPath states the issue was reported to ISC by Naresh Kandula Parmar. The content does not provide a specific date for when the report was submitted.
An ISC GitLab issue describes CVE-2026-3593 as a heap use-after-free in BIND 9 DNS-over-HTTPS triggered by crafted HTTP/2 SETTINGS frames, with potential information disclosure and denial of service. The issue publication date is explicitly shown as 2026-02-18.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
zeropath.com
Open sourcegitlab.isc.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ISC disclosed a high-severity denial-of-service vulnerability in BIND 9** tracked as **CVE-2025-13878**, where remote attackers can crash the `named` daemon by sending specially crafted DNS traffic that triggers improper handling of malformed **BRID** and **HHIT** record data structures. The issue is remotely exploitable (no authentication or user interaction required) and is scored **CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)**, making publicly exposed DNS infrastructure a primary risk. The flaw affects both **authoritative name servers and DNS resolvers**, enabling an attacker to force a service outage by causing `named` to terminate unexpectedly. Reported affected versions include **BIND 9.18.40–9.18.43**, **9.20.13–9.20.17**, and **9.21.12–9.21.16**, with fixes available in **9.18.44**, **9.20.18**, and **9.21.17** (and corresponding *SPE* preview builds). The vulnerability was reported by **Vlatko Kosturjak (Marlink Cyber)**, and ISC issued early notification ahead of public disclosure, urging administrators to verify deployed versions and apply patched releases to prevent remote crash/DoS conditions.
Jun 29, 2026
Internet Systems Consortium (ISC) disclosed six vulnerabilities in **BIND 9** and released patched versions `9.18.49`, `9.20.23`, and `9.21.22`. The issues include **CVE-2026-3039**, a high-severity memory-exhaustion flaw during GSS-API TKEY negotiation that can crash `named`; **CVE-2026-3593**, a high-severity heap use-after-free in the DNS-over-HTTPS implementation triggered by crafted HTTP/2 traffic; **CVE-2026-3592**, an amplification issue involving self-pointed glue records that can drive disproportionate bandwidth and resource consumption; **CVE-2026-5947**, a race condition in SIG(0) validation under query-flood conditions that can lead to undefined behavior and process crashes; plus additional flaws involving invalid handling of `CLASS != IN` and an unbounded resend loop in the resolver. ISC said the vulnerabilities are remotely exploitable in affected configurations, with the most serious impacts centered on denial of service, memory corruption, and resolver abuse rather than confirmed code execution. Exposure depends on feature use: the GSS-API issue is especially relevant to Active Directory-integrated or Kerberos-secured DNS deployments, while the DoH flaw affects only servers with DNS-over-HTTPS enabled and can be mitigated by disabling that feature until upgrades are applied. ISC reported no known active exploitation at disclosure time, said no workaround is known for several of the bugs, and credited external researchers including Vitaly Simonovich, Naoki Wakamatsu, Naresh Kandula Parmar, and Shuhan Zhang for reporting the flaws.
Jun 29, 2026
ISC disclosed **`CVE-2026-5947`**, a remotely exploitable use-after-free flaw in the BIND 9 recursive resolver that can crash the `named` process during **SIG(0)** signature validation. The bug stems from a race condition between asynchronous signature verification and recursive query cancellation when the `recursive-clients` quota is exhausted, allowing a `resquery_t` object to be freed while callback code still dereferences it. ISC rated the issue **CVSS 7.5** and said the demonstrated impact is denial of service, while arbitrary code execution is considered unlikely. The vulnerability affects BIND **9.20.0 through 9.20.22**, **9.21.0 through 9.21.21**, and **9.20.9-S1 through 9.20.22-S1**; the **9.18.x ESV** branch is not affected because it does not use the asynchronous SIG(0) verification path. According to ISC, no authentication is required, and exploitation is possible if an attacker controls an authoritative server or forwarder that returns SIG(0)-signed responses under query-flood conditions. Fixes were released in **9.20.23**, **9.21.22**, and **9.20.23-S1**, replacing the raw pointer handling with reference-counted attachment and corresponding detach logic.
Jul 10, 2026