Backport upstream fix for CVE-2026-10723 to bind-9.16.23.
The patch adds NSEC3 signer validation in lib/dns/dnssec.c,
rejecting signatures whose signer doesn't match the owning
zone apex. This prevents a child zone from impersonating its
parent and forging NXDOMAIN responses for sibling domains.
CVE: CVE-2026-10723
Upstream patches:
- 238ec379e9.patch
Resolves: RHEL-213499
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
