kritisch
CVE-2026-3593
bind: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Photon OS. Niedriger laut Red Hat (hoch), Azure Linux (hoch), Ubuntu (mittel).
Beschreibung
A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 5.0 | bindutils, bindutils-devel, bindutils-libs | 9.20.23-1.ph5 |
| alpine 3.20 | bind | 9.18.49-r0 |
| alpine 3.21 | bind | 9.18.49-r0 |
| alpine 3.22 | bind | 9.20.23-r0 |
| alpine 3.23 | bind | 9.20.23-r0 |
| alpine 3.24 | bind | 9.20.23-r0 |
| alpine edge | bind | 9.20.23-r0 |
| Azure Linux 3.0 | bind | 0:9.20.23-1.azl3 |
| debian 13 | bind9 | 1:9.20.23-1~deb13u1 |
| debian 14 | bind9 | 1:9.20.23-1 |
| echo | bind9 | 1:9.20.23-1~deb13u1 |
| minimos | bind | 9.20.23-r0 |
Alle 38 Einträge aus 25 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 5.0 | bindutils | 9.20.23-1.ph5 |
| Photon OS 5.0 | bindutils-devel | 9.20.23-1.ph5 |
| Photon OS 5.0 | bindutils-libs | 9.20.23-1.ph5 |
| alpine 3.20 | bind | 9.18.49-r0 |
| alpine 3.21 | bind | 9.18.49-r0 |
| alpine 3.22 | bind | 9.20.23-r0 |
| alpine 3.23 | bind | 9.20.23-r0 |
| alpine 3.24 | bind | 9.20.23-r0 |
| alpine edge | bind | 9.20.23-r0 |
| Azure Linux 3.0 | bind | 0:9.20.23-1.azl3 |
| debian 13 | bind9 | 1:9.20.23-1~deb13u1 |
| debian 14 | bind9 | 1:9.20.23-1 |
| echo | bind9 | 1:9.20.23-1~deb13u1 |
| minimos | bind | 9.20.23-r0 |
| rapidfort alpine 3.20 | bind | 9.18.49-r0, 9.20.23-r0 |
| rapidfort alpine 3.21 | bind | 9.18.49-r0, 9.20.23-r0 |
| rapidfort alpine 3.22 | bind | 9.18.49-r0, 9.20.23-r0 |
| rapidfort alpine 3.23 | bind | 9.20.23-r0 |
| rapidfort alpine 3.24 | bind | 9.20.23-r0 |
| rapidfort debian 12 | bind9 | 0:9.20.23-1~deb13u1, 1:9.20.23-1 |
| rapidfort debian 12 | rf-bind9 | 1:9.20.29-1~deb13u1 |
| rapidfort debian 13 | bind9 | 0:9.20.23-1~deb13u1, 1:9.20.23-1 |
| rapidfort debian 13 | rf-bind9 | 1:9.20.29-1~deb13u1 |
| rapidfort fedora 43 | bind9-next | 32:9.21.22-2.fc43 |
| rapidfort fedora 43 | bind9-next-chroot | 32:9.21.22-2.fc43 |
| rapidfort fedora 43 | bind9-next-dnssec-utils | 32:9.21.22-2.fc43 |
| rapidfort fedora 43 | bind9-next-doc | 32:9.21.22-2.fc43 |
| rapidfort fedora 43 | bind9-next-libs | 32:9.21.22-2.fc43 |
| rapidfort fedora 43 | bind9-next-license | 32:9.21.22-2.fc43 |
| rapidfort fedora 43 | bind9-next-utils | 32:9.21.22-2.fc43 |
| rapidfort ubuntu 20.04 | bind9 | 1:9.20.18-1ubuntu2.1 |
| rapidfort ubuntu 20.04 | rf-bind9 | 1:9.20.11-1ubuntu2.4, 1:9.20.18-1ubuntu2.1 |
| rapidfort ubuntu 22.04 | bind9 | 1:9.20.18-1ubuntu2.1 |
| rapidfort ubuntu 22.04 | rf-bind9 | 1:9.20.11-1ubuntu2.4, 1:9.20.18-1ubuntu2.1 |
| rapidfort ubuntu 24.04 | bind9 | 1:9.20.18-1ubuntu2.1 |
| rapidfort ubuntu 24.04 | rf-bind9 | 1:9.20.11-1ubuntu2.4, 1:9.20.18-1ubuntu2.1 |
| ubuntu 25.10 | bind9 | 1:9.20.11-1ubuntu2.4 |
| ubuntu 26.04 | bind9 | 1:9.20.18-1ubuntu2.1 |
Referenzen
- https://access.redhat.com/errata/RHSA-2026:7412
- https://access.redhat.com/security/cve/CVE-2026-3593
- https://bugzilla.redhat.com/show_bug.cgi?id=2479770
- https://downloads.isc.org/isc/bind9/9.20.23
- https://downloads.isc.org/isc/bind9/9.21.22
- https://kb.isc.org/docs/cve-2026-3593
- https://nvd.nist.gov/vuln/detail/CVE-2026-3593
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3593.json