CVE-2026-12617

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, named may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur.

This Important flaw in BIND can lead to a denial of service in Red Hat products. The named daemon may terminate unexpectedly when processing specific CNAME/DNAME and A record query orderings, coupled with precisely timed authoritative server responses. Exploitation requires an attacker to manipulate DNS responses from an authoritative server to a vulnerable resolver.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.