CVE-2026-12617 Record ordering based unexpected exit with CNAME or DNAME
A remote attacker can cause the BIND DNS resolver to crash by sending specific CNAME or DNAME query responses, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-12617?
CVE-2026-12617 is a high-severity denial of service vulnerability in ISC BIND 9, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Weakness: CWE-617
Which versions are affected by CVE-2026-12617?
How do I fix CVE-2026-12617?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-12617 being exploited?
There is no known exploitation of CVE-2026-12617 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-12617, AZL-93138, BELL-CVE-2026-12617, DEBIAN-CVE-2026-12617, ECHO-6d4b-e3ee-0962, GHSA-cc7q-gqfw-hrm4 and 3 more.