new file mode 100644
@@ -0,0 +1,38 @@
+From 7bd2ccb4a490b95ee9e8297ebbcb8fec91d11859 Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 20 May 2026 10:20:45 +0200
+Subject: [PATCH] - Fix CVE-2026-42960, Possible cache poisoning attack while
+ following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo
+ and JianJun Chen, Tsinghua University, for the report.
+
+(cherry picked from commit 8ae4b4545dccaaabd30b597b0dcb0d9640c8cc39)
+
+CVE: CVE-2026-42960
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/8ae4b4545dccaaabd30b597b0dcb0d9640c8cc39]
+
+Dropped changes to the Changelog file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ iterator/iter_scrub.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
+index 8507a3fb6..852705db3 100644
+--- a/iterator/iter_scrub.c
++++ b/iterator/iter_scrub.c
+@@ -725,7 +725,13 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
+ rrset->rrset_all_next = NULL;
+ return 1;
+ }
+- mark_additional_rrset(pkt, msg, rrset);
++ /* Only mark glue as allowed for type NS in the authority
++ * section. Other RR types do not get glue for them, it
++ * is allowed from the answer section, but not authority
++ * so that a message can not have address records cached
++ * as a side effect to the query. */
++ if(rrset->type==LDNS_RR_TYPE_NS)
++ mark_additional_rrset(pkt, msg, rrset);
+ prev = rrset;
+ rrset = rrset->rrset_all_next;
+ }
@@ -20,6 +20,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-41292.patch \
file://CVE-2026-42534.patch \
file://CVE-2026-42923.patch \
+ file://CVE-2026-42960.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"