CVE-2026-11605

HighCVSS 7.5/10Last modified Nov 2, 2026

Description

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-408

Affected software

Vendor	Product	Versions
ISC	BIND 9	>= 9.20.0, <= 9.20.24; >= 9.21.0, <= 9.21.23; >= 9.20.9-S1, <= 9.20.24-S1

References

https://downloads.isc.org/isc/bind9/9.20.26Product
https://downloads.isc.org/isc/bind9/9.21.24Product
https://kb.isc.org/docs/cve-2026-11605Vendor Advisory

Timeline

Published: Jul 22, 2026
Last modified: Nov 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1160507.3A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unk CVE-2026-1160524.3A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipul CVE-2026-1160535.3A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of th CVE-2026-1160542.2A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação.CVE-2026-1160556.3A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/d CVE-2026-1160566.3A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.ph CVE-2026-1160576.3A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file ap CVE-2026-1160586.3A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file CVE-2026-1160607.3A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/add CVE-2026-1160617.3A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opil CVE-2026-1160627.3A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the fi CVE-2026-1160634.7A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manip