CVE-2026-11605Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-408

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
6 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 1d ago at 4 mentions (2026-07-22); latest day: 2
6 total mentions across 2 days

Deep dive

Activity timeline6 mentions / 2d

Signal classification2 categories

Disclosure

350.0%

Patch

350.0%

Referenced assets14 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-22	4	Disclosure3Patch1
2026-07-23	2	Patch2

Full discourse6 posts

Yasuhiro Morishita@OrangeMorishita91d
Patch
【自分用メモ】BIND 9の脆弱性(High: CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321, Medium: CVE-2026-10723, CVE-2026-10822)と修正バージョン(9.20.26, 9.21.24) https://security.sios.jp/vulnerability/bind9-security-vulnerability-20260723/
Post summary
The post lists multiple BIND 9 CVEs and provides the corresponding fixed versions, indicating a patch update announcement.
12080922
4.6K followersView on X
日本レジストリサービス（JPRS）@JPRS_official91d
Patch
【注意喚起】（緊急）BIND 9.xの脆弱性（過剰なCPU負荷の誘発）について（CVE-2026-11605） - バージョンアップを強く推奨 - https://jprs.jp/tech/security/2026-07-23-bind9-vuln-validation.html
Post summary
The post alerts users to CVE-2026-11605 which causes excessive CPU load in BIND 9.x and strongly recommends upgrading to mitigate the risk.
04070554
1.3K followersView on X
Yu F@fj_twt92d
Patch
( ꒪⌓꒪)…灼熱の特大号 New BIND 9 releases: 9.20.26, 9.21.24 https://lists.isc.org/pipermail/bind-announce/2026-July/001299.html https://kb.isc.org/docs/cve-2026-10723 https://kb.isc.org/docs/cve-2026-10822 https://kb.isc.org/docs/cve-2026-11331 https://kb.isc.org/docs/cve-2026-11605 https://kb.isc.org/docs/cve-2026-11622 https://kb.isc.org/docs/cve-2026-11721 https://kb.isc.org/docs/cve-2026-12617 https://kb.isc.org/docs/cve-2026-13204 https://kb.isc.org/docs/cve-2026-13321
Post summary
The post announces new BIND 9 releases that provide patches for several CVEs, offering advisory links, but it does not detail PoCs, exploit code, or active exploitation.
01180835
1.6K followersView on X
Kazuki Omo@omokazuki91d
Disclosure
BIND 9の脆弱性(High: CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321, Medium: CVE-2026-10723, CVE-2026-10822) #sios_tech #security #vulnerability #セキュリティ #脆弱性 #dns #bind https://security.sios.jp/vulnerability/bind9-security-vulnerability-20260723/
Post summary
The post announces a set of newly discovered BIND 9 vulnerabilities, listing CVE identifiers and severity levels, and provides a link to a security advisory.
02040332
372 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-11605 The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictl… https://www.cve.org/CVERecord?id=CVE-2026-11605 ----- Traducción: CVE-2026-11605 El … http://infoflow.cloud`
Post summary
The tweet briefly announces CVE‑2026‑11605, a resource exhaustion vulnerability in BIND’s DNSSEC validation, linking to the CVE record for more details.
0000028
94 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-11605 The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictl… https://www.cve.org/CVERecord?id=CVE-2026-11605
Post summary
The entry identifies CVE‑2026‑11605 as a DNSSEC‑related resource‑exhaustion flaw in BIND that processes all RRSIG records, but offers no PoC, patch, or exploitation details.
00000765
57.8K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-11605

Yasuhiro Morishita[verified]@OrangeMorishitaPatch

The post lists multiple BIND 9 CVEs and provides the corresponding fixed versions, indicating a patch update announcement.

Yu F[verified]@fj_twtPatch

The post announces new BIND 9 releases that provide patches for several CVEs, offering advisory links, but it does not detail PoCs, exploit code, or active exploitation.

日本レジストリサービス（JPRS）@JPRS_officialPatch

The post alerts users to CVE-2026-11605 which causes excessive CPU load in BIND 9.x and strongly recommends upgrading to mitigate the risk.

Kazuki Omo@omokazukiDisclosure

The post announces a set of newly discovered BIND 9 vulnerabilities, listing CVE identifiers and severity levels, and provides a link to a security advisory.

Infoflowcloud@infoflowcloudDisclosure

The tweet briefly announces CVE‑2026‑11605, a resource exhaustion vulnerability in BIND’s DNSSEC validation, linking to the CVE record for more details.

CVE@CVEnewDisclosure

The entry identifies CVE‑2026‑11605 as a DNSSEC‑related resource‑exhaustion flaw in BIND that processes all RRSIG records, but offers no PoC, patch, or exploitation details.