CVE-2026-3593 is a heap use-after-free vulnerability in BIND's DNS-over-HTTPS implementation. An attacker can remotely trigger memory corruption by sending crafted HTTP/2 traffic to a DNS-over-HTTPS endpoint, affecting authoritative servers and resolvers. This can lead to denial of service or, in some cases, arbitrary code execution. The vulnerability is tracked under Red Hat Advisory RHSA-2026:7412 and affects Red Hat Hardened Images RPMs including bind packages. No official fix or mitigation meeting Red Hat's standards is currently available.

The vulnerability allows remote attackers to cause memory corruption via use-after-free, potentially resulting in denial of service or arbitrary code execution on affected systems running BIND with DNS-over-HTTPS enabled. Both authoritative DNS servers and resolvers configured for DNS-over-HTTPS are impacted. The severity is high due to the potential for remote exploitation without authentication.

Currently, no mitigation is available or meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates and apply patches once released. Until a fix is available, consider disabling DNS-over-HTTPS if feasible in your environment to reduce exposure.