CVE-2026-11605

The record

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.

Affected packages

Related vulnerabilities

• CVE-2026-3592 BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. CWE-408
• CVE-2026-41405 OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT… CWE-408
• CVE-2026-41374 OpenClaw before 2026.3.31 performs Discord audio preflight transcription before… CWE-408
• CVE-2026-41331 OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio… CWE-408
• GHSA-m6fx-m8hc-572m OpenClaw: Telegram audio preflight transcription enables resource consumption by… CWE-408
• GHSA-hhff-fj5f-qg48 OpenClaw runs Discord audio preflight transcription before member authorization CWE-408
• GHSA-p464-m8x6-vhv8 OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated… CWE-408