Description

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-07-22T15:16:51.963Z",
  "pubdate": "2026-07-22T15:16:51.963Z",
  "executiveSummary": "An unexpected program termination vulnerability exists in the `named` resolver component of BIND 9, leading to a Denial of Service (DoS) condition.\nThe flaw is triggered by specific ordering, timing, and content anomalies in responses from authoritative name servers regarding CNAME, DNAME, and A record queries.\nAffected products include BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.\nThe risk implication is high as a remote attacker can repeatedly crash the authoritative or recursive name server, disrupting DNS resolution services for dependent clients.\nAttack capabilities require the ability to manipulate or control a malicious authoritative name server or inject crafted responses into the resolution path, exploiting race conditions and asynchronous query handling in `named`.",
  "technicalDetails": "The vulnerability resides within the resolver component of `named` in BIND 9, specifically in how it processes and correlates asynchronous responses for related DNS queries involving DNAME or CNAME redirection alongside A records.\nThe root cause stems from improper state management and internal assertion handling when handling out-of-order, delayed, or conflicting responses from authoritative servers.\nIn the first attack vector, a client initiates queries to the resolver for a DNAME record and an A record located beneath that DNAME. An adversarial authoritative server responds positively to the A query while deliberately delaying the DNAME response, subsequently returning a negative response to the DNAME query.\nIn the second attack vector, a client queries the resolver for both a CSimilarly, a CNAME and an A record for the same target name. The malicious authoritative server responds positively to the A query, delays the CNAME response, and ultimately supplies a self-referential CNAME loop.\nWhen these specific message sequences and timing constraints are processed by `named`, internal logic errors or unmet assertions occur, causing the process to abort unexpectedly and resulting in a denial of service.\nExploitation requires no authentication or special privileges against the resolver, but relies on network exposure where the resolver processes queries directed to a malicious or compromised authoritative nameserver capable of manipulating response timing and payloads."
}