From: Ondřej Surý <ondrej@isc.org>
Date: Tue, 23 Jun 2026 05:05:01 +0000 (+0200)
Subject: [CVE-2026-11605] sec: usr: Prevent excessive validation work from crafted negative... 
X-Git-Tag: v9.21.24~11
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d60c0ae61d1e85a21b6faefc979bb317933b32c3;p=thirdparty%2Fbind9.git

[CVE-2026-11605] sec: usr: Prevent excessive validation work from crafted negative responses

A validating resolver could be made to perform a large amount of DNSSEC
validation work in response to a single answer, consuming excessive CPU. A
malicious authoritative server triggers this by returning a signed negative
answer (NXDOMAIN or NODATA) padded with many denial-of-existence proof
records, which the resolver continued to verify beyond its per-query
validation limit. It now enforces that limit on negative answers and returns
SERVFAIL once the limit is reached.

Closes: https://gitlab.isc.org/isc-projects/bind9/-/work_items/4463

Merge branch '4463-limit-the-number-of-negative-validations' into 'security-main'

See merge request isc-private/bind9!1057
---

d60c0ae61d1e85a21b6faefc979bb317933b32c3