- CVE-2026-11331: return from RPZ wildcard CNAME expansion when the resulting name is too long instead of continuing with an invalid name - CVE-2026-11721: reject RRSIG records whose Labels field is smaller than the signer's label count, and skip out-of-zone nodes in dnssec-signzone - CVE-2026-13321: reject NSEC RRsets containing a record whose Next Domain Name points outside the signer's zone - CVE-2026-10723: require the NSEC3 signer name to equal the zone apex derived from the NSEC3 owner name - CVE-2026-13204: only accept an NSEC/NSEC3 denial record that has a matching RRSIG, and propagate the failure instead of asserting - CVE-2026-11622: reference count cache RRset headers so superseded generations are reclaimed without waiting for the owning node to become unreferenced