CVE-2026-11605

{
  "id": "CVE-2026-11605",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-22T15:16:51.573",
  "lastModified": "2026-10-24T18:10:00.163",
  "vulnStatus": "Undergoing Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1."
    },
    {
      "lang": "es",
      "value": "El problema es una vulnerabilidad de agotamiento de recursos asociada con la validación DNSSEC. BIND siempre valida todos los registros RRSIG en una respuesta, incluso si no son estrictamente necesarios. Una consulta a un servidor/zona autoritativo que devuelve muchos registros RRSIG válidos pero superfluos hace que el validador desperdicie un tiempo de CPU desproporcionado.\nEste problema afecta a las versiones de BIND 9 9.20.0 a 9.20.24, 9.21.0 a 9.21.23, y 9.20.9-S1 a 9.20.24-S1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ISC",
          "product": "BIND 9",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9.20.0",
              "lessThanOrEqual": "9.20.24",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.21.0",
              "lessThanOrEqual": "9.21.23",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.20.9-S1",
              "lessThanOrEqual": "9.20.24-S1",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T18:53:47.681873Z",
          "id": "CVE-2026-11605",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-408"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://downloads.isc.org/isc/bind9/9.20.26",
      "source": "[email protected]"
    },
    {
      "url": "https://downloads.isc.org/isc/bind9/9.21.24",
      "source": "[email protected]"
    },
    {
      "url": "https://kb.isc.org/docs/cve-2026-11605",
      "source": "[email protected]"
    }
  ]
}