Resource Exhaustion via DNSSEC RRSIG Validation in BIND 9 9.20.x-9.21.x
CVE-2026-11605 Published on July 22, 2026
Unnecessary validation of DNSSEC signed records
The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time.
This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.
Vulnerability Analysis
CVE-2026-11605 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Incorrect Behavior Order: Early Amplification
The software allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.
Products Associated with CVE-2026-11605
stack.watch emails you whenever new vulnerabilities are published in ISC BIND or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
ISC BIND 9:- Version 9.20.0, <= 9.20.24 is affected.
- Version 9.21.0, <= 9.21.23 is affected.
- Version 9.20.9-S1, <= 9.20.24-S1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.