---
id: 6160
title: "CVE-2026-3593 — ISC BIND 9 DNS-over-HTTPS HTTP/2 SETTINGS Use-After-Free"
cve: CVE-2026-3593
source_domain: aretiq.ai
source_url: "https://aretiq.ai/research/vul260605-cve-2026-3593-isc-bind-9-dns-over-https-http2-settings-use-after-free/"
published_at: "2026-06-05T00:00:00Z"
tags: ["vulnerability-research", "denial-of-service", "use-after-free", "cve-2026-3593", "bind9", "dns-over-https"]
phying_url: "https://phying.com/item/6160"
lang: en
---

# CVE-2026-3593 — ISC BIND 9 DNS-over-HTTPS HTTP/2 SETTINGS Use-After-Free

## Summary

CVE-2026-3593: a use-after-free in BIND 9's DoH implementation—freed response buffers are read during HTTP/2 SETTINGS floods, crashing ASAN builds; fixed in 9.20.23 and 9.21.22.

## Intelligence Metadata

- **Sources:** aretiq.ai
- **CVE:** CVE-2026-3593
- **Published:** 2026-06-05T00:00:00Z
- **Original:** https://aretiq.ai/research/vul260605-cve-2026-3593-isc-bind-9-dns-over-https-http2-settings-use-after-free/
- **Phying News:** https://phying.com/item/6160