Add patch for CVE-2026-11721: an RRSIG whose Labels field
indicates fewer labels than its signer name requires was being
accepted, allowing cache poisoning via forged wildcard records
through RFC 8198 synthesis. The patch is a two-commit mbox: the
original upstream fix plus an adaptation replacing the
DNS_NAME_VALID() macro (BIND 9.20+) with the equivalent
ISC_MAGIC_VALID() expression available in BIND 9.18.
CVE: CVE-2026-11721
Upstream patches:
- 8a46533cbe.patch
Resolves: RHEL-213411
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
