Backport upstream fix for CVE-2026-13204 to bind9.16. The patch
ensures that dns_rdataset_addnoqname() only accepts NSEC/NSEC3
records that have matching RRSIG signatures, preventing
acceptance of unsigned records. Additionally, callers in
resolver.c and query.c now handle non-success return codes
gracefully instead of triggering assertion failures.
CVE: CVE-2026-13204
Upstream patches:
- 1b90fbb4f9.patch
Resolves: RHEL-213478
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
