_get_nearest_mirrors_by_network_data() fails to exclude near-by private mirrors for extra options.
https://github.com/AlmaLinux/mirrors/blob/mirrors_service/src/backend/api/handlers.py#L105-L117
When a client matches against the network data service cone of a mirror, the list offered to them is appended up to LENGTH_CLOUD_MIRROR_LIST (5) with other nearby mirrors.
This list of additional mirrors can include private mirrors if the private mirror accidentally included geo data in their configuration.
This suitable_mirrors.extend also fails to check the health of these additional mirrors, meaning that the additional mirrors are not verified to be ok and may be outdated or flapping.
Failure mode is that if a mirror with a specified network data match for clients goes down, when the clients slide down the list to subsequent mirrors, this list of additional mirrors is not filtered for private mirrors or only healthy mirrors.
The patch is deployed to production