This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-11605 →
ALPINE-CVE-2026-11605
The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they...
Original description
The description as published by the source.
The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time.
This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.22
bind
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.26-r0"}]}]
Alpine:v3.23
bind
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.26-r0"}]}]
Alpine:v3.24
bind
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.26-r0"}]}]
References
- advisory security.alpinelinux.org