Backport upstream fix for CVE-2026-10723 to bind 9.11.36.
The patch adds NSEC3 signer verification in lib/dns/dnssec.c,
rejecting signatures whose signer field does not match the zone
owning the NSEC3 record. This prevents a child zone from
impersonating its parent to forge NXDOMAIN responses for
sibling domains. The error message for DNS_R_INVALIDNSEC3 in
lib/dns/result.c is also updated accordingly.
CVE: CVE-2026-10723
Upstream patches:
- 6965fa47ed.patch
Resolves: RHEL-215710
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
