CVE-2026-3593 is a high-severity use-after-free vulnerability (CWE-416) found in the DNS-over-HTTPS implementation of ISC BIND 9. It affects multiple version ranges: 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. The vulnerability could lead to a high impact on confidentiality and availability, as indicated by the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H). Red Hat advisories reference this CVE but do not explicitly confirm a patch or remediation level for affected versions. No known exploits have been reported in the wild to date.

The vulnerability allows an attacker to exploit a use-after-free condition in the DNS-over-HTTPS component of BIND 9, potentially leading to a high impact on confidentiality and availability. The CVSS score of 7.4 reflects this significant risk. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisories mention updated packages for BIND 9.18.48 but do not explicitly state a fix for the affected versions in this CVE. Users should monitor official ISC and Red Hat advisories for updates and apply patches once available. Until then, no specific mitigation steps are provided by the vendor.