A vulnerability in BIND DNS server allows acceptance of a validly signed NSEC3 record from an unrelated sibling zone as proof of insecurity. This can downgrade a secure delegation and permit a forged unsigned DNS answer. The issue affects multiple BIND 9 versions prior to 9.18.21-15.oe2403sp3 and has a medium severity rating with a CVSS score of 5.9.