CVE-2026-11605 in BIND
Summary
by MITRE • 07/22/2026
The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a significant denial of service risk within the Internet Systems Consortium's BIND DNS server implementation. The issue manifests as a resource exhaustion condition that specifically targets the DNS Security Extensions validation process, where the software demonstrates inefficient processing behavior that can be exploited to consume excessive computational resources. The flaw affects multiple release branches of BIND 9, spanning versions from 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and the specialized S1 releases within the 9.20.x series, indicating this is a widespread issue affecting the core DNS validation functionality.
The technical root cause lies in BIND's DNSSEC validation mechanism which indiscriminately processes all RRSIG records present in DNS responses regardless of their necessity for validation purposes. This behavior violates the principle of efficient resource utilization and creates an opportunity for attackers to craft malicious DNS responses containing numerous superfluous RRSIG records that trigger unnecessary computational overhead. The vulnerability operates at the application layer within the DNS resolver component, specifically targeting the validation logic that handles signed DNS records as defined by RFC 4035 and related DNSSEC standards.
The operational impact of this vulnerability is substantial as it enables attackers to perform resource exhaustion attacks against DNS servers running affected BIND versions. When a resolver encounters DNS responses containing many valid but unnecessary RRSIG records, the validation process consumes disproportionate CPU cycles, potentially leading to service degradation or complete denial of service conditions. This represents a classic computational complexity attack pattern where legitimate DNS operations are made inefficient through carefully constructed response data. The vulnerability affects both recursive and iterative DNS resolution scenarios, making it particularly dangerous for authoritative servers that may be configured to validate responses from other servers.
This issue aligns with several cybersecurity frameworks and threat modeling concepts including CWE-400 which describes resource exhaustion vulnerabilities, and ATT&CK technique T1499.004 related to network denial of service attacks. The vulnerability demonstrates how seemingly benign DNSSEC features can be weaponized through improper implementation of validation logic. Organizations using affected BIND versions face increased risk during high-volume DNS traffic periods or when exposed to malicious DNS responses. The specific nature of the flaw suggests that defensive measures should focus on implementing rate limiting mechanisms, response size monitoring, and potentially configuring BIND to limit the number of RRSIG records processed during validation.
Mitigation strategies should include immediate patching of affected BIND versions to the latest stable releases which contain fixes for the excessive RRSIG processing behavior. Network administrators should also consider implementing DNS response filtering mechanisms that can detect and limit responses containing excessive RRSIG records, while monitoring for unusual CPU utilization patterns in DNS resolver processes. Additionally, configuring BIND with appropriate validation timeouts and resource limits can help contain the impact of malicious responses. The vulnerability highlights the importance of thorough testing of security features under realistic attack conditions and demonstrates how optimization issues in cryptographic validation can create exploitable weaknesses in otherwise secure systems.