CVE-2026-12617
Received Received - Intake

Unexpected Program Termination in BIND DNS Resolver

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Internet Systems Consortium (ISC)

Description
The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-12617
EUVD
EUVD-2026-47711

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
isc bind From 9.18.0 (inc) to 9.18.50 (inc)
isc bind From 9.20.0 (inc) to 9.20.24 (inc)
isc bind From 9.18.11-s1 (inc) to 9.18.50-s1 (inc)
isc bind From 9.20.9-s1 (inc) to 9.20.24-s1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-12617 is a vulnerability in BIND 9 DNS software where unexpected program termination occurs due to specific record ordering or content in responses to queries for CNAME, DNAME, or A records. If a client queries for DNAME and A records and the server responds positively to the A query but delays or negatively responds to the DNAME query, BIND may crash. Similarly, querying for CNAME and A records with delayed CNAME responses or self-referential CNAMEs can also cause BIND to terminate unexpectedly.

Detection Guidance

Monitor BIND named service logs for assertion failures or unexpected terminations. Check for crashes when processing CNAME, DNAME, or A record queries with specific ordering or content. Use tools like 'journalctl -u named' on systemd systems to review logs for 'named' crashes.

Impact Analysis

This vulnerability can cause BIND to crash unexpectedly, leading to DNS service disruption. If exploited, it may result in denial of service for DNS queries, affecting network reliability and availability. The impact depends on whether the affected BIND instance is used as a resolver or authoritative server.

Compliance Impact

This vulnerability causes unexpected termination of BIND 9 DNS software, which could lead to service disruptions or downtime. For compliance with standards like GDPR or HIPAA, which require high availability and reliability of systems processing personal or sensitive data, such disruptions may violate availability requirements. DNS failures could also impact logging and monitoring capabilities, potentially affecting audit compliance.

Mitigation Strategies

Upgrade BIND to version 9.20.26 or BIND Supported Preview Edition 9.20.26-S1 immediately. No workarounds are available. Ensure all authoritative and recursive servers are updated to prevent crashes from malformed responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12617. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart