Reorder release notes

diff --git a/doc/notes/notes-9.21.24.rst b/doc/notes/notes-9.21.24.rst
index ae39303237d885d2eaf2705c6e8cd69f86b089be..526667c60a87d7ceda80a87fa6a6b6d23959a320 100644 (file)
--- a/doc/notes/notes-9.21.24.rst
+++ b/doc/notes/notes-9.21.24.rst
@@ -15,6 +15,23 @@ Notes for BIND 9.21.24
 Security Fixes
 ~~~~~~~~~~~~~~
 
+- Correct verification of NSEC3 signer name. :cve:`2026-10723`
+
+  Previously, :iscman:`named` accepted child-zone NSEC3 records where
+  the first label equaled the hash of the parent zone as valid
+  parent-zone closest encloser proofs. This has been fixed.
+
+  ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing
+  this vulnerability to our attention. :gl:`#5874`
+
+- Malformed DNSKEY records could trigger an assertion. :cve:`2026-10822`
+
+  Previously, ``dns_name_fromwire()`` did not honor the record boundary
+  when reading names from the wire, allowing malformed records to be
+  accepted when they should not have been. In particular, malformed
+  DNSKEY records could trigger an assertion failure when being printed.
+  This has been fixed. :gl:`#6004`
+
 - Fix handling of RPZ CNAME expansion that returns too-long name.
   :cve:`2026-11331`
 
@@ -28,6 +45,24 @@ Security Fixes
   ISC would like to thank Laith Mash'al (0xmshal) for bringing this
   vulnerability to our attention. :gl:`#5856`
 
+- Prevent excessive validation work from crafted negative responses.
+  :cve:`2026-11605`
+
+  Previously, a validating resolver could be made to perform a large
+  amount of DNSSEC validation work in response to a single answer,
+  consuming excessive CPU. A malicious authoritative server could
+  trigger this by returning a signed negative answer (NXDOMAIN or
+  NODATA) padded with many denial-of-existence proof records, which the
+  resolver continued to verify beyond its per-query validation limit. It
+  now enforces that limit on negative answers and returns SERVFAIL once
+  the limit is reached. :gl:`#4463`
+
+- Prevent cache exhaustion under sustained attack. :cve:`2026-11622`
+
+  Cache memory could become exhausted with expired entries whose memory
+  was not released, due to a sustained attack on the same DNS name that
+  prevented the cleanup. This has been fixed. :gl:`#4760`
+
 - Stop accepting invalid signed wildcard records. :cve:`2026-11721`
 
   Signed wildcard responses in which the Labels field in the RRSIG
@@ -39,6 +74,14 @@ Security Fixes
   ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing
   this vulnerability to our attention. :gl:`#5871`
 
+- Prevent crash from malformed NSEC/NSEC3 response. :cve:`2026-13204`
+
+  An assertion could be triggered by an improperly signed NOQNAME proof.
+  This has been fixed.
+
+  ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing
+  this vulnerability to our attention. :gl:`#5985`
+
 - Fix DNSSEC validation bypass via out-of-zone NSEC Next Field.
   :cve:`2026-13321`
 
@@ -51,23 +94,6 @@ Security Fixes
   ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing
   this vulnerability to our attention. :gl:`#5873`
 
-- Correct verification of NSEC3 signer name. :cve:`2026-10723`
-
-  Previously, :iscman:`named` accepted child-zone NSEC3 records where
-  the first label equaled the hash of the parent zone as valid
-  parent-zone closest encloser proofs. This has been fixed.
-
-  ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing
-  this vulnerability to our attention. :gl:`#5874`
-
-- Malformed DNSKEY records could trigger an assertion. :cve:`2026-10822`
-
-  Previously, ``dns_name_fromwire()`` did not honor the record boundary
-  when reading names from the wire, allowing malformed records to be
-  accepted when they should not have been. In particular, malformed
-  DNSKEY records could trigger an assertion failure when being printed.
-  This has been fixed. :gl:`#6004`
-
 - Reclaim memory promptly when DNSSEC validations are canceled.
 
   When a resolver is flooded with queries that require DNSSEC validation
@@ -79,24 +105,6 @@ Security Fixes
   work queue is now dropped as soon as the validation is canceled,
   releasing the memory it was holding. :gl:`#4760`
 
-- Prevent excessive validation work from crafted negative responses.
-  :cve:`2026-11605`
-
-  Previously, a validating resolver could be made to perform a large
-  amount of DNSSEC validation work in response to a single answer,
-  consuming excessive CPU. A malicious authoritative server could
-  trigger this by returning a signed negative answer (NXDOMAIN or
-  NODATA) padded with many denial-of-existence proof records, which the
-  resolver continued to verify beyond its per-query validation limit. It
-  now enforces that limit on negative answers and returns SERVFAIL once
-  the limit is reached. :gl:`#4463`
-
-- Prevent cache exhaustion under sustained attack. :cve:`2026-11622`
-
-  Cache memory could become exhausted with expired entries whose memory
-  was not released, due to a sustained attack on the same DNS name that
-  prevented the cleanup. This has been fixed. :gl:`#4760`
-
 Removed Features
 ~~~~~~~~~~~~~~~~
 
@@ -243,14 +251,6 @@ Bug Fixes
   entry expired, even when the CNAME target itself was otherwise
   resolvable. This has been fixed. :gl:`#5983`
 
-- Prevent crash from malformed NSEC/NSEC3 response. :cve:`2026-13204`
-
-  An assertion could be triggered by an improperly signed NOQNAME proof.
-  This has been fixed.
-
-  ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing
-  this vulnerability to our attention. :gl:`#5985`
-
 - Reject unsupported RSA DNSKEY shapes during DNSSEC validation.
 
   An authoritative server publishing an RSA DNSKEY with an unusually