Backport upstream fix for CVE-2026-10723 to bind-9.18.33.
The patch adds NSEC3 signer validation in dns_dnssec_verify()
to reject signatures whose signer field doesn't match the zone
owning the NSEC3 record. This prevents a child zone from
impersonating its parent zone and forging NXDOMAIN responses
for sibling domains. The error message for DNS_R_INVALIDNSEC3
is also updated to reflect the broader scope of the check.
CVE: CVE-2026-10723
Upstream patches:
- c9cb6a5e24.patch
Resolves: RHEL-215707
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
