CVE-2026-11605: Unnecessary validation of DNSSEC signed records

Q: What is the severity of CVE-2026-11605?

The severity of CVE-2026-11605 is high, with a CVSS score of 7.5.

Q: What type of vulnerability is CVE-2026-11605?

CVE-2026-11605 is a resource exhaustion vulnerability associated with DNSSEC validation.

Q: How do I fix CVE-2026-11605?

To fix CVE-2026-11605, you should update to the latest version of ISC BIND that addresses this vulnerability.

Q: What software is affected by CVE-2026-11605?

ISC BIND 9 is the software affected by CVE-2026-11605.

Q: What are the consequences of CVE-2026-11605?

CVE-2026-11605 can lead to resource exhaustion, causing the DNS resolver to waste resources on unnecessary RRSIG validation.

Published Jul 22, 2026

Updated

Last updated 19 August 2026

Other sources

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.

— MITRE

Unnecessary validation of DNSSEC signed records

— Microsoft

Affected Software

12 affected componentsFixes available

ISC BIND 9>=9.20.0<=9.20.24, >=9.21.0<=9.21.23, >=9.20.9-S1<=9.20.24-S1

Microsoft azl3 bind 9.20.23-1<9.20.26-1

9.20.26-1

ISC BIND>=9.20.0<=9.20.24

ISC BIND>=9.20.9<=9.20.24

ISC BIND>=9.21.0<=9.21.23

alpine/bind>=9.20.0<9.20.26-r0

9.20.26-r0

alpine/bind>=9.20.0<9.20.26-r0

9.20.26-r0

alpine/bind>=9.20.0<9.20.26-r0

9.20.26-r0

debian/bind9<1:9.18.49-1~deb12u2

1:9.18.49-1~deb12u2

debian/bind9<1:9.20.26-1~deb13u1

1:9.20.26-1~deb13u1

debian/bind9<1:9.20.26-1

1:9.20.26-1

debian/bind9<=1:9.18.49-1~deb12u1

1:9.18.49-1~deb12u31:9.20.26-1~deb13u11:9.20.30-1~deb13u11:9.20.30-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.26-1
Upgrade
Upgrade alpine/bind to a version that resolves this vulnerability.
Fixed in 9.20.26-r0
Upgrade
Upgrade debian/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.49-1~deb12u2
Upgrade
Upgrade debian/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.26-1~deb13u1
Upgrade
Upgrade debian/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.26-1
Upgrade
Upgrade debian/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.49-1~deb12u3Fixed in 1:9.20.26-1~deb13u1Fixed in 1:9.20.30-1~deb13u1Fixed in 1:9.20.30-1
Upgrade
Upgrade ISC BIND 9 to a version that resolves this vulnerability.
Fixed in 9.20.26
Upgrade
Upgrade ISC BIND 9 to a version that resolves this vulnerability.
Fixed in 9.21.24
Upgrade
Upgrade ISC BIND 9 to a version that resolves this vulnerability.
Fixed in 9.20.26-S1

Event History

Jul 22, 2026

CVE Published

via MITRE·02:11 PM

Data Sourced

via MITRE·02:11 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:16 PM

DescriptionSeverityAffected Software

Jul 25, 2026

Data Sourced

via Microsoft·08:04 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6395

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4725-1

Frequently Asked Questions

What is the severity of CVE-2026-11605?

The severity of CVE-2026-11605 is high, with a CVSS score of 7.5.

What type of vulnerability is CVE-2026-11605?

CVE-2026-11605 is a resource exhaustion vulnerability associated with DNSSEC validation.

How do I fix CVE-2026-11605?

To fix CVE-2026-11605, you should update to the latest version of ISC BIND that addresses this vulnerability.

What software is affected by CVE-2026-11605?

ISC BIND 9 is the software affected by CVE-2026-11605.

What are the consequences of CVE-2026-11605?

CVE-2026-11605 can lead to resource exhaustion, causing the DNS resolver to waste resources on unnecessary RRSIG validation.

CVE-2026-11605: Unnecessary validation of DNSSEC signed records

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-11605?

What type of vulnerability is CVE-2026-11605?

How do I fix CVE-2026-11605?

What software is affected by CVE-2026-11605?

What are the consequences of CVE-2026-11605?

Company

Resources

Contact