Add patch for CVE-2026-13321 which rejects out-of-zone NSEC
next owner names during DNSSEC validation. The patch is based
on ISC's 9.11-specific backport commits (3bc7280158 and
27ceccfe77) which add a dns_nsec_is_legal() function and
integrate NSEC validation checks into the resolver, using
9.11-compatible APIs and coding conventions.
CVE: CVE-2026-13321
Upstream patches:
- 058023c66f.patch
- f751e19a30.patch
Resolves: RHEL-213318
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
