Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The resolver accepts validly-signed NSEC records where the "Next
  Domain Name" field points outside the signer's zone. An attacker
  controlling ANY DNSSEC-signed zone can craft NSEC records spanning
  into victim zones, enabling cross-zone cache poisoning with AD=1
  (Authenticated Data flag set)