CVE-2026-11605

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://downloads.isc.org/isc/bind9/9.20.26
https://downloads.isc.org/isc/bind9/9.21.24
https://kb.isc.org/docs/cve-2026-11605

Configurations

No configuration.

History

24 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) El problema es una vulnerabilidad de agotamiento de recursos asociada con la validación DNSSEC. BIND siempre valida todos los registros RRSIG en una respuesta, incluso si no son estrictamente necesarios. Una consulta a un servidor/zona autoritativo que devuelve muchos registros RRSIG válidos pero superfluos hace que el validador desperdicie un tiempo de CPU desproporcionado. Este problema afecta a las versiones de BIND 9 9.20.0 a 9.20.24, 9.21.0 a 9.21.23, y 9.20.9-S1 a 9.20.24-S1.

Information

Published : 2026-07-22 15:16

Updated : 2026-10-24 18:10

NVD link : CVE-2026-11605

Mitre link : CVE-2026-11605

CVE.ORG link : CVE-2026-11605

JSON object : View

Products Affected

No product.

CWE

CWE-408

Incorrect Behavior Order: Early Amplification

{"id": "CVE-2026-11605", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11605", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T18:53:47.681873Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.20.0", "versionType": "custom", "lessThanOrEqual": "9.20.24"}, {"status": "affected", "version": "9.21.0", "versionType": "custom", "lessThanOrEqual": "9.21.23"}, {"status": "affected", "version": "9.20.9-S1", "versionType": "custom", "lessThanOrEqual": "9.20.24-S1"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T15:16:51.573", "references": [{"url": "https://downloads.isc.org/isc/bind9/9.20.26", "source": "security-officer@isc.org"}, {"url": "https://downloads.isc.org/isc/bind9/9.21.24", "source": "security-officer@isc.org"}, {"url": "https://kb.isc.org/docs/cve-2026-11605", "source": "security-officer@isc.org"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-408"}]}], "descriptions": [{"lang": "en", "value": "The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1."}, {"lang": "es", "value": "El problema es una vulnerabilidad de agotamiento de recursos asociada con la validaci\u00f3n DNSSEC. BIND siempre valida todos los registros RRSIG en una respuesta, incluso si no son estrictamente necesarios. Una consulta a un servidor/zona autoritativo que devuelve muchos registros RRSIG v\u00e1lidos pero superfluos hace que el validador desperdicie un tiempo de CPU desproporcionado.\nEste problema afecta a las versiones de BIND 9 9.20.0 a 9.20.24, 9.21.0 a 9.21.23, y 9.20.9-S1 a 9.20.24-S1."}], "lastModified": "2026-10-24T18:10:00.163", "sourceIdentifier": "security-officer@isc.org"}