CVE-2026-12617

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

• CWE-617

• https://downloads.isc.org/isc/bind9/9.20.26
• https://kb.isc.org/docs/cve-2026-12617

Published

Jul 22, 2026

Last Modified

Jul 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12606Eclipse Grizzly in versions before 5.0.2, cannot properly pa…5.3
• CVE-2026-12609In Eclipse Theia versions 1.66.0 and up until including 1.73…7.5
• CVE-2026-1261The MetForm Pro plugin for WordPress is vulnerable to Stored…7.2
• CVE-2026-12610A flaw was found in sssd. When authenticating with a YubiKey…6.4
• CVE-2026-12611A client may issue HTTP/2 requests to a Jetty server that re…8.7
• CVE-2026-12616The /v1/upload/sbom endpoint extracts the iss claim from the…6.9
• CVE-2026-12618IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…7.2
• CVE-2026-12619Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-1262IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …4.3
• CVE-2026-12620The GridTime 3000 GNSS Time Server leaks the access token in…6.5
• CVE-2026-12621Improper neutralization of input during web page generation …5.4
• CVE-2026-12622The GridTime 3000 GNSS Time Server has an open redirect vuln…5.4