new file mode 100644
@@ -0,0 +1,68 @@
+From 984cbdd8761685087f1e20d6e9d9da12d7412916 Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 22 Jul 2026 10:19:28 +0200
+Subject: [PATCH] - Fix CVE-2026-56416, Possible heap buffer overflow when
+ validator canonicalizes RDATA that contains domain name. Thanks to Qifan
+ Zhang, Palo Alto Networks, for the report.
+
+(cherry picked from commit 4b1635e19406fd8040806f0fa4a4488c003b5d0d)
+
+CVE: CVE-2026-56416
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/4b1635e19406fd8040806f0fa4a4488c003b5d0d]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ util/data/msgparse.c | 3 +++
+ validator/val_sigcrypt.c | 11 +++++++----
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/util/data/msgparse.c b/util/data/msgparse.c
+index 3dc2e1264..9d3ddda7a 100644
+--- a/util/data/msgparse.c
++++ b/util/data/msgparse.c
+@@ -687,6 +687,9 @@ calc_size(sldns_buffer* pkt, uint16_t type, struct rr_parse* rr)
+ }
+ rdf++;
+ }
++ /* rdata ended before all _dname_count names were seen */
++ if(count != 0)
++ return 0; /* the rdata is too short. */
+ }
+ /* remaining rdata */
+ rr->size += pkt_len;
+diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
+index 86de6fb8e..cde281870 100644
+--- a/validator/val_sigcrypt.c
++++ b/validator/val_sigcrypt.c
+@@ -1094,6 +1094,7 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
+ size_t len)
+ {
+ uint8_t* datstart = sldns_buffer_current(buf)-len+2;
++ size_t firstlen;
+ switch(ntohs(rrset->rk.type)) {
+ case LDNS_RR_TYPE_NXT:
+ case LDNS_RR_TYPE_NS:
+@@ -1113,8 +1114,9 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
+ case LDNS_RR_TYPE_SOA:
+ /* two names after another */
+ query_dname_tolower(datstart);
+- query_dname_tolower(datstart +
+- dname_valid(datstart, len-2));
++ firstlen = dname_valid(datstart, len-2);
++ if(firstlen && firstlen < len-2)
++ query_dname_tolower(datstart + firstlen);
+ return;
+ case LDNS_RR_TYPE_RT:
+ case LDNS_RR_TYPE_AFSDB:
+@@ -1141,8 +1143,9 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
+ return;
+ datstart += 2;
+ query_dname_tolower(datstart);
+- query_dname_tolower(datstart +
+- dname_valid(datstart, len-2-2));
++ firstlen = dname_valid(datstart, len-2-2);
++ if(firstlen && firstlen < len-2-2)
++ query_dname_tolower(datstart + firstlen);
+ return;
+ case LDNS_RR_TYPE_NAPTR:
+ if(len < 2+4)
@@ -41,6 +41,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-55973.patch \
file://CVE-2026-55990.patch \
file://CVE-2026-55991.patch \
+ file://CVE-2026-56416.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"