Backport upstream commit af84538a2ce6 to fix CVE-2026-13321.
The patch adds validation in dns_dnssec_verify() to reject
out-of-zone NSEC next owner names by checking that the NSEC
next name is a subdomain of the signer field, as required by
RFC 4034 section 4.1.1.
CVE: CVE-2026-13321
Upstream patches:
- af84538a2c.patch
Resolves: RHEL-213313
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
