CVE-2026-12617 in BIND 9
Summary
by MITRE • 07/22/2026
The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical stability issue in the BIND DNS server implementation that stems from improper handling of asynchronous response ordering and content processing during recursive queries. The flaw manifests when the resolver encounters specific temporal and content-based conditions involving CNAME, DNAME, and A record responses, leading to unexpected program termination or crash scenarios. The root cause lies in the internal state management and response processing logic within named that fails to properly account for delayed or out-of-order responses from authoritative servers, particularly when dealing with complex record hierarchies and referral chains.
The technical exploitation of this vulnerability occurs through carefully crafted DNS query sequences that exploit race conditions in the resolver's response handling mechanisms. When a client queries for both DNAME and A records simultaneously, or CNAME and A records for the same name, the resolver's internal processing becomes corrupted if authoritative servers respond with specific timing patterns. The delayed negative response to DNAME queries combined with positive A record responses, or self-referential CNAME responses following initial positive A responses, triggers memory corruption or invalid state transitions within the named process. This behavior aligns with CWE-129 and CWE-130 vulnerability categories related to improper input validation and buffer overflows in DNS processing systems.
The operational impact of this vulnerability extends beyond simple denial-of-service conditions to potentially compromise the entire DNS resolution infrastructure. Since BIND is widely deployed across internet infrastructure, an attacker could exploit this issue to disrupt critical services by causing named processes to terminate unexpectedly, leading to cascading failures in DNS resolution for affected networks. The vulnerability affects multiple versions of BIND 9, spanning from 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, and their corresponding snapshot releases, indicating a widespread exposure across the software's lifecycle. This vulnerability maps to ATT&CK technique T1496 related to resource exhaustion through service disruption, and potentially to T1583 for infrastructure manipulation.
Mitigation strategies should focus on immediate patch application to versions that address the specific response ordering and state management issues within named's recursive query handling. Organizations should also implement network-level monitoring to detect unusual DNS query patterns that might indicate exploitation attempts, particularly around DNAME and CNAME record processing. Additional protective measures include implementing DNS caching strategies that reduce reliance on problematic query sequences, configuring resolver timeouts to prevent indefinite waiting states, and establishing robust process monitoring to quickly detect and restart named processes following unexpected termination events. The vulnerability highlights the importance of comprehensive testing for asynchronous response handling in DNS servers and demonstrates how seemingly benign operational conditions can lead to critical system failures.