From f61caccacf5951ae7b77c219b24f9a222fa8ab2f Mon Sep 17 00:00:00 2001
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
Date: Thu, 23 Jul 2026 11:17:06 +0000
Subject: [PATCH] Fix RPZ name-too-long wildcard expansion in bind9.16
 (CVE-2026-11331)

Backport upstream fix for CVE-2026-11331 to bind9.16. The patch
(from upstream commit ee2ac186bc) corrects the query_rpzcname()
function in lib/ns/query.c to properly handle RPZ name-too-long
wildcard expansion by returning YXDOMAIN instead of a
self-referential CNAME.

CVE: CVE-2026-11331
Upstream patches:
 - https://github.com/isc-projects/bind9/commit/ee2ac186bc5f75f7f3f7049f1a21e9a2014cee59.patch
Resolves: RHEL-213764

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
---
 bind-9.16-CVE-2026-11331.patch | 29 +++++++++++++++++++++++++++++
 bind9.16.spec                  |  9 ++++++++-
 2 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 bind-9.16-CVE-2026-11331.patch

diff --git a/bind-9.16-CVE-2026-11331.patch b/bind-9.16-CVE-2026-11331.patch
new file mode 100644
index 0000000..12d5b0a
--- /dev/null
+++ b/bind-9.16-CVE-2026-11331.patch
@@ -0,0 +1,29 @@
+From c7b516d590dd832ad9e9d85665da1a6970d0ecb3 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Fri, 10 Apr 2026 10:26:14 +1000
+Subject: [PATCH] Properly handle rpz name to long wildcard expansion
+
+Previously a self referential CNAME and the original address
+record were returned.  We now return a YXDOMAIN response.
+
+(cherry picked from commit cfc4c4f69870ce492deaaa429453563d1621ded3)
+---
+ lib/ns/query.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 4d6dd5d..bb0c629 100644
+--- a/lib/ns/query.c
++++ b/lib/ns/query.c
+@@ -7064,8 +7064,9 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) {
+ 					      qctx->fname, NULL);
+ 		if (result == DNS_R_NAMETOOLONG) {
+ 			client->message->rcode = dns_rcode_yxdomain;
+-		} else if (result != ISC_R_SUCCESS) {
+-			return (result);
++		}
++		if (result != ISC_R_SUCCESS) {
++			return result;
+ 		}
+ 	} else {
+ 		dns_name_copynf(cname, qctx->fname);
diff --git a/bind9.16.spec b/bind9.16.spec
index 74b119f..4253609 100644
--- a/bind9.16.spec
+++ b/bind9.16.spec
@@ -62,7 +62,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9.16
 License:  MPLv2.0
 Version:  9.16.23
-Release:  0.22%{?dist}.7
+Release:  0.22%{?dist}.8
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -189,6 +189,8 @@ Patch230: bind-9.16-CVE-2026-3039.patch
 Patch231: bind-9.16-CVE-2026-5946.patch
 # https://github.com/isc-projects/bind9/commit/1b90fbb4f9d3d923516ff7841171269b993cfd6f
 Patch233: bind-9.16-CVE-2026-13204.patch
+# https://github.com/isc-projects/bind9/commit/ee2ac186bc5f75f7f3f7049f1a21e9a2014cee59
+Patch234: bind-9.16-CVE-2026-11331.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -532,6 +534,7 @@ in HTML and PDF format.
 %patch230 -p1 -b .CVE-2026-3039
 %patch231 -p1 -b .CVE-2026-5946
 %patch233 -p1 -b .CVE-2026-13204
+%patch234 -p1 -b .CVE-2026-11331
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1274,6 +1277,10 @@ fi;
 %endif
 
 %changelog
+* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.8
+- Fix RPZ name-too-long wildcard expansion (CVE-2026-11331)
+- Resolves: RHEL-213478
+
 * Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.7
 - Fix CVE-2026-13204: ensure NSEC/NSEC3 has matching RRSIG
 - Resolves: RHEL-213478