new file mode 100644
@@ -0,0 +1,61 @@
+From 513f5e4be89d3b139605dfc31c3fb3728f25be2a Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 22 Jul 2026 10:13:36 +0200
+Subject: [PATCH] - Fix CVE-2026-50046, Possible heap use-after-free in an
+ error path when a DoT forwarded query is jostled out. Thanks to Qifan
+ Zhang, Palo Alto Networks, for the report.
+
+(cherry picked from commit 1ad8d4c39594dcb28d636fb4922737a3640c9a65)
+
+CVE: CVE-2026-50046
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/1ad8d4c39594dcb28d636fb4922737a3640c9a65]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ services/outside_network.c | 12 +++++++++++-
+ services/outside_network.h | 2 +-
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/services/outside_network.c b/services/outside_network.c
+index 2b7f7d0a2..bc65d36f7 100644
+--- a/services/outside_network.c
++++ b/services/outside_network.c
+@@ -195,6 +195,7 @@ static void
+ waiting_tcp_delete(struct waiting_tcp* w)
+ {
+ if(!w) return;
++ free(w->tls_auth_name);
+ if(w->timer)
+ comm_timer_delete(w->timer);
+ free(w);
+@@ -2489,7 +2490,16 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
+ w->cb = callback;
+ w->cb_arg = callback_arg;
+ w->ssl_upstream = sq->ssl_upstream;
+- w->tls_auth_name = sq->tls_auth_name;
++ if(sq->tls_auth_name) {
++ w->tls_auth_name = strdup(sq->tls_auth_name);
++ if(!w->tls_auth_name) {
++ comm_timer_delete(w->timer);
++ free(w);
++ return NULL;
++ }
++ } else {
++ w->tls_auth_name = NULL;
++ }
+ w->timeout = timeout;
+ w->id_node.key = NULL;
+ w->write_wait_prev = NULL;
+diff --git a/services/outside_network.h b/services/outside_network.h
+index 0a77e3388..81ebfe3e2 100644
+--- a/services/outside_network.h
++++ b/services/outside_network.h
+@@ -412,7 +412,7 @@ struct waiting_tcp {
+ void* cb_arg;
+ /** if it uses ssl upstream */
+ int ssl_upstream;
+- /** ref to the tls_auth_name from the serviced_query */
++ /** owned copy of the tls_auth_name (malloced) */
+ char* tls_auth_name;
+ /** the packet was involved in an error, to stop looping errors */
+ int error_count;
@@ -29,6 +29,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-44621.patch \
file://CVE-2026-44687.patch \
file://CVE-2026-50045.patch \
+ file://CVE-2026-50046.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"