CVE-2026-12617: Record ordering based unexpected exit with CNAME or DNAME
The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, named may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ISC BIND 9to a version that resolves this vulnerability.Fixed in 9.20.26 - Upgrade
Upgrade
ISC BIND 9to a version that resolves this vulnerability.Fixed in 9.20.26-S1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12617?
The severity of CVE-2026-12617 is rated as high with a score of 7.5.
How does CVE-2026-12617 affect ISC BIND 9?
CVE-2026-12617 affects ISC BIND 9 by causing unexpected program termination due to specific content ordering in responses for CNAME, DNAME, and A records.
What is the risk associated with CVE-2026-12617?
The risk associated with CVE-2026-12617 is categorized as 43, indicating a significant potential for disruption.
How do I mitigate CVE-2026-12617?
To mitigate CVE-2026-12617, it is recommended to apply patches or updates to ISC BIND 9 as provided by the vendor.
When was CVE-2026-12617 published and modified?
CVE-2026-12617 was published and modified on July 22, 2026.