diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-50251.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-50251.patch
new file mode 100644
index 0000000000..5800ea8572
--- /dev/null
+++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-50251.patch
@@ -0,0 +1,72 @@
+From 2a514d577f035b1473d34201290be4394c732ff7 Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 22 Jul 2026 10:15:02 +0200
+Subject: [PATCH] - Fix CVE-2026-50251, Attacker supplied `0.0.0.0`/`::` glue
+ triggers   defensive full-cache flush. Thanks to Qifan Zhang, Palo Alto  
+ Networks, for the report.
+
+(cherry picked from commit e180b06298d8d39a764d3c5d4d4aca472c3a97d7)
+
+CVE: CVE-2026-50251
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/e180b06298d8d39a764d3c5d4d4aca472c3a97d7]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ doc/unbound.conf.rst             |  7 +++++++
+ iterator/iter_donotq.c           | 12 ++++++++++++
+ testdata/dns_error_reporting.rpl |  1 +
+ 3 files changed, 20 insertions(+)
+
+diff --git a/doc/unbound.conf.rst b/doc/unbound.conf.rst
+index d83816c6f..ca96a4411 100644
+--- a/doc/unbound.conf.rst
++++ b/doc/unbound.conf.rst
+@@ -1954,6 +1954,13 @@ These options are part of the **server:** clause.
+     flushing away any poison.
+     A value of 10 million is suggested.
+ 
++    It is useful to add 0.0.0.0/8 and '::' to the
++    :ref:`do-not-query-address<unbound.conf.do-not-query-address>` list.
++    Otherwise they may be answered, from localhost, and the different source
++    makes an unwanted reply that unnecessarily ticks up.
++    The :ref:`do-not-query-localhost<unbound.conf.do-not-query-localhost>`
++    option includes them, the zero subnets, when it is enabled.
++
+     Default: 0 (disabled)
+ 
+ 
+diff --git a/iterator/iter_donotq.c b/iterator/iter_donotq.c
+index 40ffb45c4..7eecf1354 100644
+--- a/iterator/iter_donotq.c
++++ b/iterator/iter_donotq.c
+@@ -132,6 +132,18 @@ donotq_apply_cfg(struct iter_donotq* dq, struct config_file* cfg)
+ 		if(cfg->do_ip6) {
+ 			if(!donotq_str_cfg(dq, "::1"))
+ 				return 0;
++			if(!donotq_str_cfg(dq, "::ffff:127.0.0.0/104"))
++				return 0;
++		}
++		/* RFC 1122 3.2.1.3 / RFC 6890 / RFC 4291 2.5.2: not valid as
++		 * destination; on Linux these route to the local host. */
++		if(!donotq_str_cfg(dq, "0.0.0.0/8"))
++			return 0;
++		if(cfg->do_ip6) {
++			if(!donotq_str_cfg(dq, "::"))
++				return 0;
++			if(!donotq_str_cfg(dq, "::ffff:0:0/96"))
++				return 0;
+ 		}
+ 	}
+ 	addr_tree_init_parents(&dq->tree);
+diff --git a/testdata/dns_error_reporting.rpl b/testdata/dns_error_reporting.rpl
+index f1fac12a2..22175cade 100644
+--- a/testdata/dns_error_reporting.rpl
++++ b/testdata/dns_error_reporting.rpl
+@@ -12,6 +12,7 @@ server:
+ 	ede: no  # It is not needed for dns-error-reporting; only for clients to receive EDEs
+ 	dns-error-reporting: yes
+ 	do-ip6: no
++	do-not-query-localhost: no
+ 
+ stub-zone:
+ 	name: domain
diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
index b6b6ecef33..0a511f767e 100644
--- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
@@ -32,6 +32,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
            file://CVE-2026-50046.patch \
            file://CVE-2026-50243.patch \
            file://CVE-2026-50248.patch \
+           file://CVE-2026-50251.patch \
            "
 
 SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"