BIND 9 (9.18.0 Through 9.18.50) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/bind-9-9.18.0-through-9.18.50/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 22 Jul 2026 15:22:33 +0000CVE-2026-12617: BIND 9 Denial of Service via Malicious DNS Responseshttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-12617-bind-dos/Wed, 22 Jul 2026 15:22:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-12617-bind-dos/This vulnerability affects BIND 9 resolver (`named`) and can lead to unexpected program termination (denial of service). The issue occurs when the resolver receives specific, delayed, or out-of-order responses to queries for CNAME or DNAME and A records. Specifically, if an authoritative server delays a DNAME or self-referential CNAME response while providing an A record, the `named` process may crash.CVE-2026-12617 describes a denial-of-service (DoS) vulnerability impacting the named resolver in various versions of BIND 9. This critical issue stems from how the named process handles specific, delayed, or out-of-order DNS responses, particularly for CNAME, DNAME, and A records. An attacker, by controlling or compromising an authoritative DNS server, can craft a scenario where a client queries for certain record types (e.g., DNAME and an A record below it, or a CNAME and an A record for the same name). If the authoritative server then delivers a positive A record response but delays and subsequently provides a negative DNAME response or a self-referential CNAME response, the named process can terminate unexpectedly. This vulnerability affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, and specific S1 versions, leading to a disruption of DNS resolution services.

Attack Chain

  1. A client system initiates DNS queries to a vulnerable BIND 9 named resolver.
  2. The client's query specifically requests a DNAME record and an A record located hierarchically below that DNAME, or requests a CNAME record and an A record for the same name.
  3. A malicious or compromised authoritative DNS server intercepts these queries or is the designated authority.
  4. The malicious authoritative server immediately responds to the A record query with a positive resolution.
  5. Concurrently, the authoritative server intentionally delays its response to the DNAME or CNAME query.
  6. After a delay, the authoritative server sends a negative response for the DNAME query or a self-referential CNAME response for the CNAME query.
  7. The vulnerable BIND 9 named resolver, processing these out-of-order or specific responses, encounters an unexpected internal state.
  8. The named process terminates abruptly, resulting in a denial of service for DNS resolution services provided by that instance.

Impact

Successful exploitation of CVE-2026-12617 leads directly to a denial of service (DoS) for the affected BIND 9 named resolver. When the named process terminates unexpectedly, it ceases to resolve DNS queries, rendering any services relying on that DNS server unreachable. This can disrupt critical network functions, internal and external website access, email delivery, and any other system dependent on DNS resolution. The impact can range from temporary outages to prolonged service interruptions depending on the organization's DNS infrastructure and recovery procedures.

Recommendation

  • Patch CVE-2026-12617 immediately by upgrading all affected BIND 9 installations to the patched versions provided by ISC.
  • Monitor DNS server health and process uptime for named using host-level monitoring tools (e.g., systemd, monit, nagios).
  • Implement robust logging for DNS query and response anomalies to potentially identify unusual response patterns that could precede or indicate exploitation attempts of CVE-2026-12617.
]]>lowadvisorydenial-of-servicevulnerabilitydnsbindlinux