CVE-2026-12617: BIND 9 DNS DoS Vulnerability

CVE-2026-12617 Overview

CVE-2026-12617 is an assertion failure in ISC BIND 9 that causes the named resolver to terminate unexpectedly. The flaw is triggered by specific ordering and content of authoritative responses to queries for CNAME or DNAME records alongside A records. A remote attacker who controls or influences authoritative server responses can crash resolvers, producing a denial-of-service condition against DNS infrastructure.

The issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. The vulnerability is classified under [CWE-617] (Reachable Assertion).

Critical Impact
A network-reachable attacker can force named to abort, disrupting DNS resolution for downstream clients and dependent services.

Affected Products

ISC BIND 9.18.0 through 9.18.50
ISC BIND 9.20.0 through 9.20.24
ISC BIND Supported Preview Editions 9.18.11-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1

Discovery Timeline

2026-07-22 - CVE-2026-12617 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-12617

Vulnerability Analysis

The vulnerability resides in how named processes concurrent resolutions involving CNAME or DNAME chains alongside A record lookups. When a client queries a resolver for a DNAME and an A record beneath that DNAME, the resolver dispatches parallel queries to the authoritative server. If the authoritative server answers the A query positively but delays the DNAME response and later returns a negative answer, an internal state inconsistency triggers an assertion failure inside named.

A parallel condition exists for CNAME processing. When a client queries for both a CNAME and an A record at the same name, and the authoritative response order returns the positive A record first followed by a self-referential CNAME, named reaches the same failure state. The result in both cases is unexpected program termination.

Root Cause

The defect is a reachable assertion in the resolver's response handling logic. Internal invariants assume specific orderings between chained record answers and their negative or self-referential counterparts. When authoritative responses violate these expectations, the assertion fires and terminates the process instead of gracefully handling the malformed chain.

Attack Vector

The attack requires no authentication and no user interaction. An attacker operates an authoritative name server for a zone, or influences one, and crafts response timing and content that a targeted recursive resolver will fetch on behalf of any client. Because recursive resolvers routinely follow client-driven query patterns, a single triggering query from any client can be used to induce the crash on shared resolvers.

See the ISC CVE-2026-12617 Documentation for authoritative technical details.

Detection Methods for CVE-2026-12617

Indicators of Compromise

Unexpected named process exits accompanied by assertion failure messages in BIND logs.
Repeated resolver restarts correlated with recursive queries for zones containing DNAME or CNAME records.
Client-side DNS resolution failures or timeouts against previously stable resolvers.

Detection Strategies

Monitor named logs for assertion failed entries and abnormal process termination events.
Alert on named service restarts and crash-loop patterns from init systems such as systemd.
Inspect query logs for repeated CNAME/DNAME plus A record lookups against unfamiliar or attacker-controlled zones preceding crashes.

Monitoring Recommendations

Track resolver uptime and query success rates to detect availability degradation early.
Forward BIND syslog output to a centralized logging platform for correlation across resolver instances.
Baseline expected DNAME and CNAME query volumes so anomalous spikes trigger investigation.

How to Mitigate CVE-2026-12617

Immediate Actions Required

Upgrade BIND 9.20.x deployments to 9.20.26 or later using the ISC BIND 9.20.26 Release build.
Upgrade BIND 9.18.x deployments to the patched release specified in the ISC advisory.
Supported Preview Edition subscribers should upgrade to the corresponding fixed -S1 build issued by ISC.
Restart named after upgrade and confirm the running version reports the patched release.

Patch Information

ISC has published fixed builds. Consult the ISC CVE-2026-12617 Documentation for the complete list of patched versions and download the 9.20.26 release from the ISC downloads server. Package maintainers for major Linux distributions typically ship backported fixes; apply vendor updates as soon as they are available.

Workarounds

No configuration workaround is published by ISC; upgrading is the supported remediation.
Restrict recursion to trusted client networks using allow-recursion to reduce exposure while patching.
Deploy multiple resolver instances behind a load balancer so a single-process crash does not remove DNS service entirely.

bash

# Configuration example: restrict recursion to internal clients
options {
    recursion yes;
    allow-recursion { 10.0.0.0/8; 192.168.0.0/16; localhost; };
    allow-query-cache { 10.0.0.0/8; 192.168.0.0/16; localhost; };
};