Backport fix for CVE-2026-11721 to bind9.16-9.16.23. Two upstream
commits were cherry-picked:
1. Reject RRSIG records whose Labels field indicates fewer labels
than the signer name requires, preventing cache poisoning via
forged wildcard records.
2. Prevent dnssec-signzone from signing extraneous records that
are not within the zone namespace.
CVE: CVE-2026-11721
Upstream patches:
- 15089066b1.patch
- 1a4986e253.patch
Resolves: RHEL-213406
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
