CVE-2026-11605

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time.

This vulnerability is rated as Important for Red Hat products because an unauthenticated remote attacker can exhaust CPU resources on recursive nameservers, leading to a complete denial of service for legitimate DNS clients without requiring special privileges. The risk is elevated on Red Hat Enterprise Linux where BIND is deployed as a recursive resolver with default DNSSEC validation enabled. Environments running authoritative-only instances or those with recursion disabled do not process third-party validation and are therefore not susceptible to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.