BIND 9 CVE-2026-11605

The target must be a BIND 9 instance performing DNSSEC validation (the default for recursive resolvers on affected 9.20.x, 9.21.x, and 9.20.x-S1 builds); authoritative-only servers without validation are not the vector. The attacker must control, or be able to serve responses for, an authoritative server/zone, and must get the victim resolver to issue a query for a name in that zone - achievable indirectly by luring users to resolve attacker-chosen domains. The exploitable behavior is BIND unconditionally validating every RRSIG in an answer, so the attacker's zone returning many valid superfluous RRSIG records is the concrete trigger. Limiting factors: impact is confined to CPU/availability (no data disclosure or code execution), and resolvers configured to only serve trusted clients or that do not validate reduce exposure; per CVSS the attack is network-reachable, low-complexity, and requires no authentication or user interaction on the resolver itself.

The signals are internally consistent: CVSS 3.1 is 7.5 with AV:N/AC:L/PR:N/UI:N and a pure availability impact (C:N/I:N/A:H), indicating a remotely reachable, low-complexity, unauthenticated DoS with no data exposure. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no POC was supplied either, so this should be treated as a credible but not-yet-weaponized issue. The practical priority is driven by prevalence rather than exploit maturity - BIND is ubiquitous as a resolver, and DNSSEC validation is commonly enabled, so a working exploit could affect a large population. Mitigating the risk assessment: an attacker must induce the target resolver to query an attacker-influenced authoritative zone, and impact is limited to CPU/availability degradation rather than code execution or data compromise. Net: a real 'patch promptly' issue for internet-facing or high-QPS validating resolvers, but not an emergency on the level of an actively exploited RCE.

An attacker registers or controls a DNSSEC-signed authoritative zone and configures it to return responses stuffed with many valid but superfluous RRSIG records. They then cause a victim's validating BIND resolver to look up names in that zone - for example by embedding the domain in a web page, email, or ad that many users load - and each resolution forces the validator to verify all the extra signatures, spiking CPU. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) and lack of authentication (PR:N) make weaponization straightforward once the response-crafting technique is known.