CVE-2026-11605

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11605
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11605.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-11605
Downstream
ALPINE (1)
AZL (1)
BELL (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (3)
OESA (1)
openSUSE (2)
RHSA (1)
SUSE (1)
UBUNTU (1)
Related
openSUSE (2)
SUSE (1)
Published
2026-07-22T15:16:51Z
Modified
2026-11-04T02:47:24Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.

References

Affected packages

Git / github.com/isc-projects/bind9

Affected ranges

Type
GIT
Repo
https://github.com/isc-projects/bind9
Events
Introduced
14bbdfc7b9db0870a0b8941ca8812d9983fdba1a
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
98f2a5b7f486829b5644e5e9d6119c8cfefcdf70
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
b732da695eecc0526950e2c722cde0bf23e5a070
Last Affected
ef0603035791f16bc3bb7de20099b7b4434a24cb
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.20.0"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
            "range": [
                {
                    "introduced": "9.20.9"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.21.0"
                },
                {
                    "last_affected": "9.21.23"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11605.json"

Git / gitlab.isc.org/isc-projects/bind9

Affected ranges

Type
GIT
Repo
https://gitlab.isc.org/isc-projects/bind9
Events
Introduced
14bbdfc7b9db0870a0b8941ca8812d9983fdba1a
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
98f2a5b7f486829b5644e5e9d6119c8cfefcdf70
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
b732da695eecc0526950e2c722cde0bf23e5a070
Last Affected
ef0603035791f16bc3bb7de20099b7b4434a24cb
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.20.0"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
            "range": [
                {
                    "introduced": "9.20.9"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.21.0"
                },
                {
                    "last_affected": "9.21.23"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11605.json"