Backport upstream commit 204fde85 to fix CVE-2026-13204.
The dns_rdataset_addnoqname() function could accept unsigned
NSEC/NSEC3 records, causing an assertion failure. The fix
restructures the NSEC/NSEC3 search to require a matching RRSIG
signature and replaces RUNTIME_CHECK assertions with graceful
error handling in query.c, rbtdb.c, rdatalist.c, and
resolver.c.
CVE: CVE-2026-13204
Upstream patches:
- 204fde8595.patch
Resolves: RHEL-213489
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
