CVE-2026-11605: BIND 9 DNSSEC DoS Vulnerability

CVE-2026-11605 Overview

CVE-2026-11605 is a resource exhaustion vulnerability in ISC BIND 9 that affects DNSSEC validation logic. BIND validates all RRSIG records returned in a DNS answer, even when those signatures are not required to establish trust. An attacker can query an authoritative server or zone that returns many valid but superfluous RRSIG records, forcing the validator to consume disproportionate CPU resources. The flaw is classified under [CWE-408] and impacts BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.

Critical Impact
Remote unauthenticated attackers can degrade or disable BIND resolver availability by triggering excessive RRSIG validation, causing sustained CPU exhaustion on affected DNS servers.

Affected Products

ISC BIND 9 versions 9.20.0 through 9.20.24
ISC BIND 9 versions 9.21.0 through 9.21.23
ISC BIND 9 Supported Preview Edition 9.20.9-S1 through 9.20.24-S1

Discovery Timeline

2026-07-22 - CVE CVE-2026-11605 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-11605

Vulnerability Analysis

The vulnerability resides in BIND's DNSSEC validator, which processes every RRSIG record present in a DNS response. DNSSEC allows multiple signatures over the same RRset, typically to support key rollover or algorithm transitions. BIND validates each signature regardless of whether verification has already succeeded with a preceding signature. An authoritative server operator can craft a zone that returns many valid RRSIG records for a single RRset. Each additional signature forces the resolver to perform costly asymmetric cryptographic operations, consuming CPU cycles per query.

Root Cause

The root cause is inefficient algorithmic behavior in the DNSSEC validation path, as categorized by [CWE-408] (Incorrect Behavior Order: Early Amplification). BIND lacks short-circuit logic to stop signature validation once a single valid RRSIG has confirmed the RRset. This design choice causes CPU work to scale linearly with the number of signatures included in a response.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sets up an authoritative DNS server that hosts a zone signed with many RRSIG records per RRset. The attacker then induces target BIND resolvers to query names within that zone, either directly or through referral chains. Each query causes the resolver to perform excessive validation work. Repeated queries amplify CPU consumption and can render the resolver unresponsive to legitimate traffic. The vulnerability affects availability only. It does not disclose data or permit code execution.

See the ISC CVE-2026-11605 Documentation for additional technical detail.

Detection Methods for CVE-2026-11605

Indicators of Compromise

Sustained high CPU utilization on named processes without a corresponding increase in query volume from clients.
Elevated DNSSEC validation latency reported in BIND statistics channel counters such as ValFail and validation duration histograms.
Recursive queries repeatedly targeting the same external zones that return unusually large numbers of RRSIG records per RRset.

Detection Strategies

Monitor named process CPU consumption against baseline and alert on prolonged saturation of a single core, which is typical of validator loops.
Analyze packet captures or query logs for responses containing an atypical count of RRSIG records for a single owner name and type.
Correlate resolver performance degradation with outbound query patterns to identify attacker-controlled authoritative zones.

Monitoring Recommendations

Enable BIND statistics channel and export counters to a metrics platform for continuous visibility into validation load.
Track DNS response time percentiles from client-side probes to identify resolver degradation early.
Log and review zones with anomalously high RRSIG counts using passive DNS or resolver query telemetry.

How to Mitigate CVE-2026-11605

Immediate Actions Required

Upgrade BIND 9.20.x installations to version 9.20.26 or later.
Upgrade BIND 9.21.x installations to version 9.21.24 or later.
Subscribers using the Supported Preview Edition should upgrade to the fixed -S1 release provided by ISC.
Restrict recursive service to trusted client networks using allow-recursion and allow-query access control lists.

Patch Information

ISC has released fixed versions available at ISC BIND 9.20.26 Download and ISC BIND 9.21.24 Download. Refer to the ISC CVE-2026-11605 Documentation for release notes and upgrade guidance.

Workarounds

No configuration-level workaround eliminates the vulnerability. Upgrading is the only complete remediation.
Limit exposure by ensuring resolvers are not open to the public internet and by applying rate limiting at network boundaries.
Consider deploying response-policy zones or query filtering to block resolution of known malicious authoritative zones.

bash

# Restrict recursion to internal networks in named.conf
options {
    recursion yes;
    allow-recursion { 10.0.0.0/8; 192.168.0.0/16; localhost; };
    allow-query-cache { 10.0.0.0/8; 192.168.0.0/16; localhost; };
    minimal-responses yes;
};