Backport fix for CVE-2026-11721 to bind 9.11 on c8s. The patch
combines two upstream commits (06778424f0 and e5b16cfd1c) that
prevent dnssec-signzone from signing out-of-zone records and
reject RRSIG records whose labels field indicates fewer labels
than the signer name requires, closing a cache poisoning vector
via forged wildcard records.
CVE: CVE-2026-11721
Upstream patches:
- 06778424f0.patch
- e5b16cfd1c.patch
Resolves: RHEL-213407
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
