Description
The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time.
This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.
Published: 2026-07-22
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability causes resource exhaustion by mandating the verification of every RRSIG record returned in a DNS answer, even when many are unnecessary. An attacker can craft queries that return a large number of valid, superfluous RRSIG entries, forcing the server to process each one and consume disproportionate CPU time.

Affected Systems

ISC BIND 9 is vulnerable in versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and the 9.20.9‑S1 through 9.20.24‑S1 series. Upgrading to the patched releases 9.20.26, 9.21.24, or 9.20.26‑S1 removes the flaw.

Risk and Exploitability

The CVSS score of 7.5 indicates a high risk for denial of service. The EPSS score is reported as less than 1 %, signifying a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that it can be triggered by crafted DNS queries from any remote client. An attacker can target the authoritative server, causing the validator to spend excessive CPU time on each query and potentially degrade service for legitimate users.

Generated by OpenCVE AI on August 3, 2026 at 23:35 UTC.

Remediation

Vendor Solution

Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.26, 9.21.24, or 9.20.26-S1.

Vendor Workaround

No workarounds known.

OpenCVE Recommended Actions

  • Upgrade BIND 9 to the patched releases 9.20.26, 9.21.24, or 9.20.26‑S1 to eliminate the redundant RRSIG validation.
  • Configure BIND’s built‑in rate limiting or apply firewall rules to restrict the volume of incoming DNS queries to the authoritative servers, thereby limiting the impact of a resource exhaustion attack.
  • Monitor CPU usage and DNS query rates on authoritative servers, and investigate any abnormal spikes in processing time or query volume to detect and mitigate ongoing exploitation attempts.

Generated by OpenCVE AI on August 3, 2026 at 23:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4725-1 bind9 security update
Debian DSA Debian DSA DSA-6395-1 bind9 security update
History

Thu, 23 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-400
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 23 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
First Time appeared Isc bind 9
Vendors & Products Isc bind 9

Wed, 22 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Description The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.
Title Unnecessary validation of DNSSEC signed records
First Time appeared Isc
Isc bind
Weaknesses CWE-408
CPEs cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Vendors & Products Isc
Isc bind
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Isc Bind Bind 9
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: isc

Published:

Updated: 2026-07-22T18:53:55.674Z

Reserved: 2026-06-08T15:26:55.139Z

Link: CVE-2026-11605

cve-icon Vulnrichment

Updated: 2026-07-22T18:53:52.283Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-07-22T15:16:51.573

Modified: 2026-07-22T20:33:11.590

Link: CVE-2026-11605

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-22T00:00:00Z

Links: CVE-2026-11605 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T23:45:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-408

    Incorrect Behavior Order: Early Amplification