CVE-2026-11605

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-408

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
ISCBIND 9>= 9.20.0, <= 9.20.24; >= 9.21.0, <= 9.21.23; >= 9.20.9-S1, <= 9.20.24-S1

References

Timeline

Published
Jul 22, 2026
Last modified
Oct 24, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-116077.6Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed wiCVE-2026-116086.1The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versionsCVE-2026-11613.5A vulnerability was detected in pbrong hrms 1.0.1. The affected element is the function UpdateRecruitmentById of the file /handler/recruitmeCVE-2026-116108.8A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integriCVE-2026-116116.5A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenCVE-2026-116139.8The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_CVE-2026-116146.4The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attributes' pCVE-2026-116168.8The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. ThisCVE-2026-116173.1Tanium addressed a compression bomb vulnerability in Findings.CVE-2026-116187.3A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function preHandle of the file taier-data-develop/sCVE-2026-116196.3A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanCVE-2026-11629.8A flaw has been found in UTT HiPER 810 1.7.4-141218. The impacted element is the function strcpy of the file /goform/setSysAdm. This manipul