new file mode 100644
@@ -0,0 +1,98 @@
+From 40a9f83c64c94b974e6b6f75e4ef350debf86577 Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 22 Jul 2026 10:11:04 +0200
+Subject: [PATCH] - Fix CVE-2026-42955, Extra fix for CVE-2026-40622 to also
+ clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain'
+ delegation renewal via glue records. Thanks to Qifan Zhang, Palo Alto
+ Networks, for the report.
+
+(cherry picked from commit 13ec8d0f261ee7900ac67cfece551e8a703d14b1)
+
+CVE: CVE-2026-42955
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/13ec8d0f261ee7900ac67cfece551e8a703d14b1]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ services/cache/rrset.c | 12 +++++++++---
+ testdata/iter_prefetch_fail.rpl | 8 ++++----
+ 2 files changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/services/cache/rrset.c b/services/cache/rrset.c
+index 81f4e2820..b5fee1dc9 100644
+--- a/services/cache/rrset.c
++++ b/services/cache/rrset.c
+@@ -126,7 +126,8 @@ rrset_cache_touch(struct rrset_cache* r, struct ub_packed_rrset_key* key,
+
+ /** see if rrset needs to be updated in the cache */
+ static int
+-need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
++need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns,
++ int a_aaaa)
+ {
+ struct packed_rrset_data* newd = (struct packed_rrset_data*)nd;
+ struct packed_rrset_data* cached = (struct packed_rrset_data*)cd;
+@@ -151,9 +152,13 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
+ return 0;
+ /* ghost-domain: never let an NS overwrite extend lifetime
+ * past the entry it replaces, regardless of trust. */
+- if(ns && !TTL_IS_EXPIRED(cached->ttl, timenow) &&
++ /* Also for A/AAAA and it is glue. */
++ if((ns ||
++ (a_aaaa && cached->trust==rrset_trust_add_noAA))
++ && !TTL_IS_EXPIRED(cached->ttl, timenow) &&
+ newd->ttl > cached->ttl) {
+ size_t i;
++ if(a_aaaa) newd->trust=rrset_trust_add_noAA;
+ newd->ttl = cached->ttl;
+ for(i=0; i<(newd->count+newd->rrsig_count); i++)
+ if(newd->rr_ttl[i] > newd->ttl)
+@@ -223,7 +228,8 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
+ equal = rrsetdata_equal((struct packed_rrset_data*)k->entry.
+ data, (struct packed_rrset_data*)e->data);
+ if(!need_to_update_rrset(k->entry.data, e->data, timenow,
+- equal, (rrset_type==LDNS_RR_TYPE_NS))) {
++ equal, (rrset_type==LDNS_RR_TYPE_NS),
++ (rrset_type==LDNS_RR_TYPE_A || rrset_type==LDNS_RR_TYPE_AAAA))) {
+ /* cache is superior, return that value */
+ lock_rw_unlock(&e->lock);
+ ub_packed_rrset_parsedelete(k, alloc);
+diff --git a/testdata/iter_prefetch_fail.rpl b/testdata/iter_prefetch_fail.rpl
+index d1e308305..aa94d0fe5 100644
+--- a/testdata/iter_prefetch_fail.rpl
++++ b/testdata/iter_prefetch_fail.rpl
+@@ -319,7 +319,7 @@ example.com. 360 IN NS ns.example.com.
+ SECTION ADDITIONAL
+ ; this is picked up from the parent (because this simulation has the
+ ; parent respond with servfail, not actually timeout)
+-ns.example.com. 3600 IN A 1.2.3.4
++ns.example.com. 360 IN A 1.2.3.4
+ ENTRY_END
+
+ ; another query to see if there is another lookup towards the authority
+@@ -342,7 +342,7 @@ www.example.com. 360 IN A 10.20.30.40
+ SECTION AUTHORITY
+ example.com. 360 IN NS ns.example.com.
+ SECTION ADDITIONAL
+-ns.example.com. 3600 IN A 1.2.3.4
++ns.example.com. 360 IN A 1.2.3.4
+ ENTRY_END
+
+ ; some time later another query, and now it is fine to bother the authority
+@@ -367,7 +367,7 @@ www.example.com. 330 IN A 10.20.30.40
+ SECTION AUTHORITY
+ example.com. 330 IN NS ns.example.com.
+ SECTION ADDITIONAL
+-ns.example.com. 3570 IN A 1.2.3.4
++ns.example.com. 330 IN A 1.2.3.4
+ ENTRY_END
+ ; now the just-looked-up entry
+ STEP 190 QUERY
+@@ -388,7 +388,7 @@ www.example.com. 3600 IN A 10.20.30.40
+ SECTION AUTHORITY
+ example.com. 3600 IN NS ns.example.com.
+ SECTION ADDITIONAL
+-ns.example.com. 3570 IN A 1.2.3.4
++ns.example.com. 3600 IN A 1.2.3.4
+ ENTRY_END
+
+
@@ -25,6 +25,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-44608.patch \
file://CVE-2026-46582.patch \
file://CVE-2026-32665.patch \
+ file://CVE-2026-42955.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"