CVE-2026-12617

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.18.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.18.11-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1

Description Unexpected program termination occurs in named due to the ordering or specific content of responses to queries for A records combined with CNAME or DNAME records. This happens in two scenarios: first, when a client queries for a DNAME and an A record below that DNAME, and the authoritative server provides a positive A response but a delayed negative DNAME response. Second, when a client queries for a CNAME and an A record for the same name, and the server provides a positive A response followed by a delayed self-referential CNAME response.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.