ISC BIND 9 CVE-2026-12617

Exploitation requires named to be running as a recursive resolver and to be induced into resolving a name in a zone whose authoritative server the attacker controls, so the attacker can order responses: a positive answer to the A query followed by a delayed DNAME response that later resolves negatively, or a delayed CNAME response that is self-referential, for the same/adjacent name. Limiting factors: authoritative-only servers are not affected; the attacker must control (or spoof at the right time) the authoritative responses and win the response-ordering race; and the resolver must be reachable for and willing to recurse the triggering query - resolvers with recursion locked down to trusted clients (allow-recursion ACLs) are harder to steer. No end-user authentication is required (PR:N) and no victim user interaction with the resolver itself is needed beyond a client query being issued.

This is a genuine availability threat but not a top-tier emergency. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is internally consistent: no confidentiality or integrity impact, availability-only, network-reachable without authentication. The realistic complexity is arguably higher than AC:L implies because the attacker must win a response-ordering race and lure or coerce the resolver into querying an attacker-influenced zone, but an attacker who owns the authoritative server fully controls answer timing and content and can retry cheaply, so reliable triggering is plausible. No EPSS score, KEV entry, or POC was provided, so exploitation should be treated as no public exploit identified at time of analysis rather than active. Note a data conflict: the input Tags say 'Information Disclosure,' which contradicts the CVSS impact (C:N, A:H) and the description - this is a crash/DoS, not disclosure; the tag appears mislabeled and should not drive prioritization. Priority is elevated for anyone running an internet-facing recursive resolver on an affected version, moderate otherwise.

An attacker registers or controls a domain and its authoritative server, then induces a victim resolver to look up a DNAME (or CNAME) and an A record beneath the same name - for example by embedding a hostname in a web page, email, or ad served to users behind that resolver. The authoritative server answers the A query positively but delays the DNAME/CNAME answer and then returns a negative or self-referential CNAME, tripping the assertion and terminating named, dropping DNS service for every client of that resolver. No public exploit code is identified at time of analysis, but the conditions are attacker-controllable and repeatable.