CVE-2026-12617 PUBLISHED

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, named may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

We are not aware of any active exploits.

No workarounds known.

Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.26 or 9.20.26-S1.

• ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this vulnerability to our attention.

• CVE-2026-12617
• https://downloads.isc.org/isc/bind9/9.20.26

• CWE-617 Reachable Assertion CWE

• If one of these situations is encountered, BIND may exit with an assertion.