new file mode 100644
@@ -0,0 +1,59 @@
+From 6e6c039d23afb169991fa489c2010ab0069a2cab Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 22 Jul 2026 10:18:41 +0200
+Subject: [PATCH] - Fix CVE-2026-55990, Packet of death for a DNSCrypt
+ misconfigured Unbound. Thanks to Qifan Zhang, Palo Alto Networks, for the
+ report.
+
+(cherry picked from commit ae1b3810cc3a8eb9b43c378289f74020b42aa7f4)
+
+CVE: CVE-2026-55990
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/ae1b3810cc3a8eb9b43c378289f74020b42aa7f4]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ dnscrypt/dnscrypt.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/dnscrypt/dnscrypt.c b/dnscrypt/dnscrypt.c
+index 173484cdf..bf858361f 100644
+--- a/dnscrypt/dnscrypt.c
++++ b/dnscrypt/dnscrypt.c
+@@ -663,6 +663,8 @@ dnsc_find_cert(struct dnsc_env* dnscenv, struct sldns_buffer* buffer)
+ }
+ dnscrypt_header = (struct dnscrypt_query_header *)sldns_buffer_begin(buffer);
+ for (i = 0U; i < dnscenv->signed_certs_count; i++) {
++ if(!certs[i].keypair)
++ continue;
+ if (memcmp(certs[i].magic_query, dnscrypt_header->magic_query,
+ DNSCRYPT_MAGIC_HEADER_LEN) == 0) {
+ return &certs[i];
+@@ -804,6 +806,7 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
+ sizeof *env->keypairs);
+ env->certs = sodium_allocarray(env->signed_certs_count,
+ sizeof *env->certs);
++ memset(env->certs, 0, env->signed_certs_count * sizeof(*env->certs));
+
+ cert_id = 0U;
+ keypair_id = 0U;
+@@ -963,12 +966,19 @@ dnsc_create(void)
+ int
+ dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg)
+ {
++ int nkeys;
+ if(dnsc_parse_certs(env, cfg) <= 0) {
+ fatal_exit("dnsc_apply_cfg: no cert file loaded");
+ }
+- if(dnsc_parse_keys(env, cfg) <= 0) {
++ nkeys = dnsc_parse_keys(env, cfg);
++ if(nkeys <= 0) {
+ fatal_exit("dnsc_apply_cfg: no key file loaded");
+ }
++ if((size_t)nkeys < env->signed_certs_count) {
++ fatal_exit("dnsc_apply_cfg: %u dnscrypt-provider-cert file(s) have no "
++ "matching dnscrypt-secret-key",
++ (unsigned)(env->signed_certs_count - (size_t)nkeys));
++ }
+ randombytes_buf(env->hash_key, sizeof env->hash_key);
+ env->provider_name = cfg->dnscrypt_provider;
+
@@ -39,6 +39,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-55708.patch \
file://CVE-2026-55717.patch \
file://CVE-2026-55973.patch \
+ file://CVE-2026-55990.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"