Add patch to reject out-of-zone NSEC next owner names, which
could allow a malicious zone to cover a victim zone for
non-existence in a DNSSEC validating resolver's cache, bypassing
DNSSEC validation (CVE-2026-13321).
The patch includes system tests, the upstream fix, and an
adaptation to the bind-9.18 codebase to resolve a compilation
issue with the cherry-picked commits.
CVE: CVE-2026-13321
Upstream patches:
- 36f3d50f9c.patch
Resolves: RHEL-213324
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
