diff --git a/bind-9.16-CVE-2026-10723.patch b/bind-9.16-CVE-2026-10723.patch
new file mode 100644
index 0000000..1f4bb19
--- /dev/null
+++ b/bind-9.16-CVE-2026-10723.patch
@@ -0,0 +1,63 @@
+From 35e6c3ff81d289627c5b3d63a68187e450740e50 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Thu, 21 May 2026 14:41:55 -0700
+Subject: [PATCH] Check NSEC3 signer matches the owning zone
+
+When validating NSEC3 records, reject any signature whose signer field
+does not match the zone owning the NSEC3.
+
+This ensures that a child zone cannot impersonate its parent and forge
+NXDOMAIN responses for sibling domains.
+
+Fixes: isc-projects/bind9#5874
+(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b)
+---
+ lib/dns/dnssec.c | 19 +++++++++++++++++--
+ lib/dns/result.c |  2 +-
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
+index c168fed..a91cbe3 100644
+--- a/lib/dns/dnssec.c
++++ b/lib/dns/dnssec.c
+@@ -426,10 +426,25 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 	}
+ 
+ 	/*
+-	 * NS, SOA and DNSSKEY records are signed by their owner.
+-	 * DS records are signed by the parent.
++	 * NS, SOA and DNSKEY records are signed by their owners.
++	 * NSEC3 records are signed by the apex, exactly one level up
++	 * from their owner names.
++	 * DS records are signed by the parent zone.
+ 	 */
+ 	switch (set->type) {
++	case dns_rdatatype_nsec3: {
++		dns_name_t apex = DNS_NAME_INITEMPTY;
++		labels = dns_name_countlabels(name);
++		if (labels <= 1) {
++			inc_stat(dns_dnssecstats_fail);
++			return DNS_R_INVALIDNSEC3;
++		}
++		dns_name_split(name, labels - 1, NULL, &apex);
++		if (!dns_name_equal(&apex, &sig.signer)) {
++			inc_stat(dns_dnssecstats_fail);
++			return DNS_R_SIGINVALID;
++		}
++	} break;
+ 	case dns_rdatatype_ns:
+ 	case dns_rdatatype_soa:
+ 	case dns_rdatatype_dnskey:
+diff --git a/lib/dns/result.c b/lib/dns/result.c
+index 01ce2b4..9ff2a3a 100644
+--- a/lib/dns/result.c
++++ b/lib/dns/result.c
+@@ -146,7 +146,7 @@ static const char *text[DNS_R_NRESULTS] = {
+ 	"covering NSEC record returned",       /*%< 101 DNS_R_COVERINGNSEC */
+ 	"MX is an address",		       /*%< 102 DNS_R_MXISADDRESS */
+ 	"duplicate query",		       /*%< 103 DNS_R_DUPLICATE */
+-	"invalid NSEC3 owner name (wildcard)", /*%< 104 DNS_R_INVALIDNSEC3 */
++	"invalid NSEC3 owner name",	       /*%< 104 DNS_R_INVALIDNSEC3 */
+ 
+ 	"not master",	      /*%< 105 DNS_R_NOTMASTER */
+ 	"broken trust chain", /*%< 106 DNS_R_BROKENCHAIN */
diff --git a/bind9.16.spec b/bind9.16.spec
index f735fa2..b5d8f7f 100644
--- a/bind9.16.spec
+++ b/bind9.16.spec
@@ -62,7 +62,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9.16
 License:  MPLv2.0
 Version:  9.16.23
-Release:  0.22%{?dist}.11
+Release:  0.22%{?dist}.12
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -198,6 +198,8 @@ Patch235: bind-9.16-CVE-2026-11721.patch
 Patch236: bind-9.16-CVE-2026-11622.patch
 # https://github.com/isc-projects/bind9/commit/af84538a2ce6722b89b8ef7f2a233a5c10d0207d
 Patch237: bind-9.16-CVE-2026-13321.patch
+# https://github.com/isc-projects/bind9/commit/238ec379e9bed56383ba2333e711e554b139ac13
+Patch238: bind-9.16-CVE-2026-10723.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -545,6 +547,7 @@ in HTML and PDF format.
 %patch235 -p1 -b .CVE-2026-11721
 %patch236 -p1 -b .CVE-2026-11622
 %patch237 -p1 -b .CVE-2026-13321
+%patch238 -p1 -b .CVE-2026-10723
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1287,6 +1290,10 @@ fi;
 %endif
 
 %changelog
+* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.12
+- Fix NSEC3 signer validation (CVE-2026-10723)
+- Resolves: RHEL-213499
+
 * Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.11
 - Reject out-of-zone NSEC next owner names (CVE-2026-13321)
 - Resolves: RHEL-213313