The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8648-1 advisory.

    It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning     zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing     DNSSEC validation. (CVE-2026-10723)

    It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote     attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2026-10822)

    It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A     remote attacker could possibly use this issue to bypass configured RPZ policies. (CVE-2026-11331)

    It was discovered that Bind performed unnecessary validation of DNSSEC signed records. A remote attacker     could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service.
    This issue only affected Ubuntu 26.04 LTS. (CVE-2026-11605)

    It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could     possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of     service. (CVE-2026-11622)

    It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and     RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks.
    (CVE-2026-11721)

    It was discovered that Bind incorrectly handled certain CNAME and DNAME record orderings in the resolver.
    A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2026-12617)

    It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC     validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. (CVE-2026-13321)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates
    all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative
    server/zone which returns many valid but superfluous RRSIG records causes the validator to waste
    disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through
    9.21.23, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-11605)

An update of the bindutils package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21489-1 advisory.

    This update for bind fixes the following issues

    - Upgrade to release 9.20.26
    - CVE-2026-10723: Incorrect acceptance of NSEC3 records (bsc#1271982).
    - CVE-2026-10822: Key Record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983).
    - CVE-2026-11331: Potential wildcard CNAME RPZ policy bypass (bsc#1271984).
    - CVE-2026-11605: Unnecessary validation of DNSSEC signed records (bsc#1271985).
    - CVE-2026-11622: Potential memory usage beyond configured limits (bsc#1271986).
    - CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards     (bsc#1271987).
    - CVE-2026-12617: Record ordering based unexpected exit with CNAME or DNAME (bsc#1271988).
    - CVE-2026-13204: Unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
    - CVE-2026-13321: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (bsc#1271990).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3426-1 advisory.

    Upgrade to release 9.20.26.

    Security issues fixed:

    - CVE-2026-10723: incorrect acceptance of NSEC3 records (bsc#1271982).
    - CVE-2026-10822: key record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983).
    - CVE-2026-11331: potential wildcard CNAME RPZ policy bypass (bsc#1271984).
    - CVE-2026-11605: unnecessary validation of DNSSEC signed records (bsc#1271985).
    - CVE-2026-11622: potential memory usage beyond configured limits (bsc#1271986).
    - CVE-2026-11721: cache poisoning possible with label count discrepancy, RRSIG, and wildcards     (bsc#1271987).
    - CVE-2026-12617: record ordering based unexpected exit with CNAME or DNAME (bsc#1271988).
    - CVE-2026-13204: unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
    - CVE-2026-13321: DNSSEC validation bypass via out-of-zone NSEC Next field (bsc#1271990).

    Other updates and bugfixes:

    - Release 9.20.26:
      * Reclaim memory promptly when DNSSEC validations are canceled.
      * Removed Features:
        * Remove the secondary validator in query.c.
        * Remove ineffective TCP fallback after repeated UDP timeouts.
      * Feature Changes:
        * Fall back to TCP on receipt of a UDP response with a mismatched           query ID.
        * Limit the number of glue records cached from a referral.
        * Fix a resolver stall on a CNAME response to a DS query.
      * Bug Fixes:
        * Fix a bug in DNS UPDATE processing with inline-signing enabled.
        * Properly detect private records before copying.
        * Tighten referral DS acceptance.
        * Don't synthesize negative responses with pending NSEC.
        * Check that an NSEC signer is at or above the name to be           validated.
        * Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN.
        * Fix a deny-answer-aliases configuration bypass issue.
        * Reject external referrals from forwarders.
        * Fix a zone transfer over TLS (XoT) issue when using the           opportunistic TLS mode.
        * Unvalidated opt-out NSEC3 could be accepted in insecurity           proof.
        * Check wildcard signer and NOQNAME signer match.
        * Fix CNAME resolution failure caused by a cached SERVFAIL           response.
        * Reject unsupported RSA DNSKEY shapes during DNSSEC validation.
        * Fix a bug in GeoIP2 string matching.
        * Fix DNS-over-HTTPS (DoH) quota configuration issue.
        * Truncated reply to a TSIG query no longer stalls the resolver.
        * Ignore updates removing DNSKEY RRset with class ANY.
        * Ignore 0-byte reads in the TCP read callback.
        * Only print per-zone glue stats when zone-statistics is set to           full.
        * CDS/CDNSKEY records were not removed when re-configuring the           server.
        * Fix a crash when querying an empty non-terminal in a wildcard           zone in RBTDB.
        * Stop reusing outgoing TCP connections the peer has already           closed.
        * Fix DNSSEC validation failures for names under an apex DNAME.
          * The resolver now removes other RRsets at the same name when             caching a CNAME.
        * Fix nxdomain-redirect combined with dns64.
        * Fix DNS64 owner case after DNAME restart.
        * Clear REDIRECT flag when it isn't needed.
        * Disable output escaping in bind9.xsl.
        * Fix crash on badly configured secondary signer.
        * Fix a possible crash on concurrent TKEY DELETE for the same           key.
        * Reject RRSIG records covering meta-types.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6395 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6395-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 22, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : bind9     CVE ID         : CVE-2026-10723 CVE-2026-10822 CVE-2026-11331 CVE-2026-11605                      CVE-2026-11622 CVE-2026-11721 CVE-2026-12617 CVE-2026-13204                      CVE-2026-13321

    Several vulnerabilities were discovered in BIND, a DNS server     implementation, which may result in bypass of DNSSEC validation, RPZ     policy bypass, cache poisoning or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 1:9.20.26-1~deb13u1.

    We recommend that you upgrade your bind9 packages.

    For the detailed security status of bind9 please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/bind9

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
365383	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Bind vulnerabilities (USN-8648-1)	Nessus	Ubuntu Local Security Checks	Local	high
462428	Echo: bind9: security update to 1:9.20.26-1~deb13u1	Tenable Cloud Security	Echo Local Security Checks	Local	high
462428	Echo: bind9: security update to 1:9.20.26-1~deb13u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
335493	Photon OS 5.0: Bindutils PHSA-2026-5.0-92-0956	Nessus	PhotonOS Local Security Checks	Local	high
331566	openSUSE 16: bind / bind-modules-bdbhpt / bind-modules-generic / etc (openSUSE-SU-2026:21489-1)	Nessus	SuSE Local Security Checks	Local	high
331433	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:3426-1)	Nessus	SuSE Local Security Checks	Local	high
329075	Debian dsa-6395 : bind9 - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2026-11605

high

Tenable Plugins

high

high

high

high

high

high

high