The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.

debian_linux dla-4725: Debian dla-4725 : bind9 - security update

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21489-1 advisory.

    This update for bind fixes the following issues

    - Upgrade to release 9.20.26
    - CVE-2026-10723: Incorrect acceptance of NSEC3 records (bsc#1271982).
    - CVE-2026-10822: Key Record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983).
    - CVE-2026-11331: Potential wildcard CNAME RPZ policy bypass (bsc#1271984).
    - CVE-2026-11605: Unnecessary validation of DNSSEC signed records (bsc#1271985).
    - CVE-2026-11622: Potential memory usage beyond configured limits (bsc#1271986).
    - CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards     (bsc#1271987).
    - CVE-2026-12617: Record ordering based unexpected exit with CNAME or DNAME (bsc#1271988).
    - CVE-2026-13204: Unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
    - CVE-2026-13321: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (bsc#1271990).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3426-1 advisory.

    Upgrade to release 9.20.26.

    Security issues fixed:

    - CVE-2026-10723: incorrect acceptance of NSEC3 records (bsc#1271982).
    - CVE-2026-10822: key record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983).
    - CVE-2026-11331: potential wildcard CNAME RPZ policy bypass (bsc#1271984).
    - CVE-2026-11605: unnecessary validation of DNSSEC signed records (bsc#1271985).
    - CVE-2026-11622: potential memory usage beyond configured limits (bsc#1271986).
    - CVE-2026-11721: cache poisoning possible with label count discrepancy, RRSIG, and wildcards     (bsc#1271987).
    - CVE-2026-12617: record ordering based unexpected exit with CNAME or DNAME (bsc#1271988).
    - CVE-2026-13204: unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
    - CVE-2026-13321: DNSSEC validation bypass via out-of-zone NSEC Next field (bsc#1271990).

    Other updates and bugfixes:

    - Release 9.20.26:
      * Reclaim memory promptly when DNSSEC validations are canceled.
      * Removed Features:
        * Remove the secondary validator in query.c.
        * Remove ineffective TCP fallback after repeated UDP timeouts.
      * Feature Changes:
        * Fall back to TCP on receipt of a UDP response with a mismatched           query ID.
        * Limit the number of glue records cached from a referral.
        * Fix a resolver stall on a CNAME response to a DS query.
      * Bug Fixes:
        * Fix a bug in DNS UPDATE processing with inline-signing enabled.
        * Properly detect private records before copying.
        * Tighten referral DS acceptance.
        * Don't synthesize negative responses with pending NSEC.
        * Check that an NSEC signer is at or above the name to be           validated.
        * Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN.
        * Fix a deny-answer-aliases configuration bypass issue.
        * Reject external referrals from forwarders.
        * Fix a zone transfer over TLS (XoT) issue when using the           opportunistic TLS mode.
        * Unvalidated opt-out NSEC3 could be accepted in insecurity           proof.
        * Check wildcard signer and NOQNAME signer match.
        * Fix CNAME resolution failure caused by a cached SERVFAIL           response.
        * Reject unsupported RSA DNSKEY shapes during DNSSEC validation.
        * Fix a bug in GeoIP2 string matching.
        * Fix DNS-over-HTTPS (DoH) quota configuration issue.
        * Truncated reply to a TSIG query no longer stalls the resolver.
        * Ignore updates removing DNSKEY RRset with class ANY.
        * Ignore 0-byte reads in the TCP read callback.
        * Only print per-zone glue stats when zone-statistics is set to           full.
        * CDS/CDNSKEY records were not removed when re-configuring the           server.
        * Fix a crash when querying an empty non-terminal in a wildcard           zone in RBTDB.
        * Stop reusing outgoing TCP connections the peer has already           closed.
        * Fix DNSSEC validation failures for names under an apex DNAME.
          * The resolver now removes other RRsets at the same name when             caching a CNAME.
        * Fix nxdomain-redirect combined with dns64.
        * Fix DNS64 owner case after DNAME restart.
        * Clear REDIRECT flag when it isn't needed.
        * Disable output escaping in bind9.xsl.
        * Fix crash on badly configured secondary signer.
        * Fix a possible crash on concurrent TKEY DELETE for the same           key.
        * Reject RRSIG records covering meta-types.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates     all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative     server/zone which returns many valid but superfluous RRSIG records causes the validator to waste     disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through     9.21.23, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-11605)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6395 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6395-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 22, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : bind9     CVE ID         : CVE-2026-10723 CVE-2026-10822 CVE-2026-11331 CVE-2026-11605                      CVE-2026-11622 CVE-2026-11721 CVE-2026-12617 CVE-2026-13204                      CVE-2026-13321

    Several vulnerabilities were discovered in BIND, a DNS server     implementation, which may result in bypass of DNSSEC validation, RPZ     policy bypass, cache poisoning or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 1:9.20.26-1~deb13u1.

    We recommend that you upgrade your bind9 packages.

    For the detailed security status of bind9 please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/bind9

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
331566	openSUSE 16: bind / bind-modules-bdbhpt / bind-modules-generic / etc (openSUSE-SU-2026:21489-1)	Nessus	SuSE Local Security Checks	Local	high
331433	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:3426-1)	Nessus	SuSE Local Security Checks	Local	high
329425	Linux Distros Unpatched Vulnerability : CVE-2026-11605	Nessus	Misc.	Local	high
329075	Debian dsa-6395 : bind9 - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2026-11605

high

Tenable Plugins

Coming Soon

high

high

high

high