A vulnerability in BIND DNS server allows a validly signed NSEC3 record from an unrelated sibling zone to be accepted as proof of insecurity. This can downgrade a secure delegation and permit a forged unsigned DNS answer. The issue affects multiple BIND 9 versions and has been fixed in version 9.18.21-15.oe2403sp1.