A use-after-free vulnerability in the DNS-over-HTTPS implementation of ISC BIND 9 poses a risk of service disruption and potential memory exploitation.

This is a use-after-free vulnerability (CWE-416) within the DNS-over-HTTPS component. The vulnerability is triggered when the application improperly handles memory, which can lead to crashes or arbitrary code execution by an unauthenticated attacker.

The vulnerability carries a CVSS score of 7.4, indicating a High severity risk. Successful exploitation could lead to a denial-of-service (DoS) condition, impacting critical DNS infrastructure, or potentially allow an attacker to gain unauthorized control over the affected BIND server, compromising the integrity of network traffic.

Immediate Action: Upgrade immediately to the patched releases: 9.20.23, 9.21.22, or 9.20.23-S1.

Proactive Monitoring: Monitor BIND 9 process logs for unexpected termination or segmentation faults that may indicate an exploitation attempt.

Compensating Controls: If immediate patching is not feasible, consider disabling DNS-over-HTTPS functionality if it is not business-critical to mitigate the primary attack vector.

Public Exploit Available: false

Given the central role of DNS services, this vulnerability requires urgent attention. Administrators should prioritize patching BIND instances to the specified versions to prevent potential service instability and unauthorized access, ensuring that critical infrastructure remains resilient against exploitation.