Description
The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur.
This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Published: 2026-07-22
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw causes the named daemon to terminate unexpectedly when an authoritative server responds to a CNAME or DNAME query in a delayed fashion after sending an A record. The delayed or self-referential CNAME, combined with a prior A response, triggers a crash that stops the DNS resolver service. The failure is deterministic for the described query patterns.

Affected Systems

International Systems Consortium BIND 9 is impacted. The vulnerability exists in versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11‑S1 through 9.18.50‑S1, and 9.20.9‑S1 through 9.20.24‑S1. Any installation running these releases that processes standard DNS queries can be affected.

Risk and Exploitability

The CVSS score of 7.5 rates this as high severity, while an EPSS score below 1% indicates a very low current exploitation probability. The vulnerability is not listed in CISA KEV. Based on the description, attackers could trigger the failure by sending crafted DNS queries or manipulating authoritative responses; it is inferred that no privileged access is required. The resulting denial of service can disrupt all clients relying on the affected DNS server.

Generated by OpenCVE AI on August 3, 2026 at 23:34 UTC.

Remediation

Vendor Solution

Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.26 or 9.20.26-S1.

Vendor Workaround

No workarounds known.

OpenCVE Recommended Actions

  • Upgrade ISC BIND 9 to release 9.20.26 or the next available patched release (e.g., 9.20.26‑S1).
  • Restart the named daemon after upgrading so the new code is loaded.
  • No temporary workaround is available; apply the patch promptly to restore availability.

Generated by OpenCVE AI on August 3, 2026 at 23:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4725-1 bind9 security update
Debian DSA Debian DSA DSA-6395-1 bind9 security update
History

Thu, 23 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 23 Jul 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Isc bind 9
Vendors & Products Isc bind 9

Wed, 22 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Description The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Title Record ordering based unexpected exit with CNAME or DNAME
First Time appeared Isc
Isc bind
Weaknesses CWE-617
CPEs cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Vendors & Products Isc
Isc bind
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Isc Bind Bind 9
cve-icon MITRE

Status: PUBLISHED

Assigner: isc

Published:

Updated: 2026-07-22T18:48:15.278Z

Reserved: 2026-06-18T13:52:43.335Z

Link: CVE-2026-12617

cve-icon Vulnrichment

Updated: 2026-07-22T18:48:11.314Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-07-22T15:16:51.963

Modified: 2026-07-22T20:33:11.590

Link: CVE-2026-12617

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-22T00:00:00Z

Links: CVE-2026-12617 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T23:45:06Z

Weaknesses