CVE-2026-12617

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

• CWE-617

• https://downloads.isc.org/isc/bind9/9.20.26Product
• https://kb.isc.org/docs/cve-2026-12617Vendor Advisory

Published

Jul 22, 2026

Last Modified

Nov 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126164A improper neutralization of special elements used in an sql…9.4
• CVE-2026-126165A memory allocation with excessive size value vulnerability …7.5
• CVE-2026-126166A improper neutralization of argument delimiters in a comman…7.2
• CVE-2026-126167A improper neutralization of special elements used in a comm…7.2
• CVE-2026-126168A improper neutralization of argument delimiters in a comman…7.2
• CVE-2026-126169A improper neutralization of argument delimiters in a comman…7.2
• CVE-2026-126170A improper encoding or escaping of output vulnerability in F…9.8
• CVE-2026-126171A use of externally-controlled format string vulnerability i…7.2
• CVE-2026-126175A improper neutralization of special elements used in an sql…8.8
• CVE-2026-126176A xml injection (aka blind xpath injection) vulnerability in…8.1
• CVE-2026-126177A xml injection (aka blind xpath injection) vulnerability in…8.1
• CVE-2026-126178A heap-based buffer overflow vulnerability in Fortinet Forti…7.2