# CVE-2026-12617: ISC BIND 9 denial of service via CNAME or DNAME record ordering

Source: https://junglewise.ai/threats/cve-2026-12617-isc-bind-9-denial-of-service-via-cname-or-dname-record-ordering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-12617 · Severity: high · CVSS 7.5 · Published 2026-07-22

A vulnerability in BIND 9, a widely used system for translating domain names into IP addresses, can cause the service to crash unexpectedly. This occurs when the system receives specific, out-of-order responses to network queries. If exploited, this could lead to a denial-of-service, disrupting internet connectivity or internal network operations for organizations relying on the affected software.

Technologies: [Isc BIND 9](https://junglewise.ai/threats/technologies/bind-9). Vendors: [Isc](https://junglewise.ai/threats/vendors/isc).

## Quick answers

**Is CVE-2026-12617 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12617 being exploited in the wild.

**How severe is CVE-2026-12617?** High severity, with a CVSS score of 7.5, published 22 July 2026.

**Which products and versions are affected?** Isc BIND 9 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1.

**Is there a fix for CVE-2026-12617?** A patch was published on 2026-07-22: Release of BIND 9.20.26 and 9.20.26-S1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12617 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-12617?** Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reachable assertion (CWE-617) exists in BIND 9's 'named' process when handling specific DNS record sequences. The vulnerability is triggered when a resolver receives an 'A' record response followed by a delayed negative DNAME response, or a delayed self-referential CNAME response. An attacker can exploit this remotely by providing these malformed or specifically ordered responses from an authoritative server, causing the 'named' service to terminate unexpectedly. The issue affects BIND versions 9.18.0 through 9.18.50 and 9.20.0 through 9.20.24, including Supported Preview Editions. Users are advised to upgrade to BIND 9.20.26 or the relevant patched version for their branch.

## Affected products

- ISC BIND 9 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1

## Timeline

- 2026-07-15: other: Early Notification (v1.0)
- 2026-07-22: disclosed: Public disclosure (v2.0)
- 2026-07-22: patched: Release of BIND 9.20.26 and 9.20.26-S1

## References

- [https://downloads.isc.org/isc/bind9/9.20.26](https://downloads.isc.org/isc/bind9/9.20.26)
- [https://kb.isc.org/docs/cve-2026-12617](https://kb.isc.org/docs/cve-2026-12617)

## Related threats

- [ISC BIND recursive server assert failure denial of service](https://junglewise.ai/threats/cve-2026-97313-a-recursive-bind-server-that-receives-a-query-with-recursion)
- [ISC BIND DNSSEC validation bypass in NSEC records](https://junglewise.ai/threats/cve-2026-13321-isc-bind-dnssec-validation-bypass-in-nsec-records)
- [ISC BIND 9 denial of service via NSEC and NSEC3 assertion failure](https://junglewise.ai/threats/cve-2026-13204-isc-bind-9-denial-of-service-via-nsec-and-nsec3-assertion-failure)
- [ISC BIND 9 cache poisoning via RRSIG label count discrepancy](https://junglewise.ai/threats/cve-2026-11721-isc-bind-9-cache-poisoning-via-rrsig-label-count-discrepancy)
- [ISC BIND 9 resource exhaustion in DNSSEC validating resolver](https://junglewise.ai/threats/cve-2026-11622-isc-bind-9-resource-exhaustion-in-dnssec-validating-resolver)