CVE-2026-11605 ISC CVE debrief

Who should care

Users of BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1 should be aware of this resource exhaustion vulnerability associated with DNSSEC validation.

Technical summary

The vulnerability is caused by BIND's validation of all RRSIG records in an answer, even when not strictly necessary. This can lead to excessive CPU usage when a query returns many valid but superfluous RRSIG records. The affected versions are BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1. Users should review their BIND configurations and update to a non-vulnerable version to mitigate this high severity vulnerability.

Defensive priority

High priority should be given to updating BIND to a version that is not vulnerable, as this is a high severity vulnerability with a CVSS score of 7.5.

Recommended defensive actions

• Update BIND to a version outside of the affected ranges (9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1).
• Implement rate limiting on DNS queries to reduce the impact of potential attacks.
• Monitor DNS server performance and adjust configurations as necessary to prevent resource exhaustion.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-22T15:16:51.573Z and was last modified on 2026-07-22T20:33:11.590Z. The NVD entry is currently Awaiting Analysis. References include updates to BIND versions 9.20.26 and 9.21.24, as well as a knowledge base article on the CVE.

Official resources