diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-56416.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-56416.patch
new file mode 100644
index 0000000000..6002c44924
--- /dev/null
+++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-56416.patch
@@ -0,0 +1,68 @@
+From 984cbdd8761685087f1e20d6e9d9da12d7412916 Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 22 Jul 2026 10:19:28 +0200
+Subject: [PATCH] - Fix CVE-2026-56416, Possible heap buffer overflow when
+ validator   canonicalizes RDATA that contains domain name. Thanks to Qifan  
+ Zhang, Palo Alto Networks, for the report.
+
+(cherry picked from commit 4b1635e19406fd8040806f0fa4a4488c003b5d0d)
+
+CVE: CVE-2026-56416
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/4b1635e19406fd8040806f0fa4a4488c003b5d0d]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ util/data/msgparse.c     |  3 +++
+ validator/val_sigcrypt.c | 11 +++++++----
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/util/data/msgparse.c b/util/data/msgparse.c
+index 3dc2e1264..9d3ddda7a 100644
+--- a/util/data/msgparse.c
++++ b/util/data/msgparse.c
+@@ -687,6 +687,9 @@ calc_size(sldns_buffer* pkt, uint16_t type, struct rr_parse* rr)
+ 			}
+ 			rdf++;
+ 		}
++		/* rdata ended before all _dname_count names were seen */
++		if(count != 0)
++			return 0; /* the rdata is too short. */
+ 	}
+ 	/* remaining rdata */
+ 	rr->size += pkt_len;
+diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
+index 86de6fb8e..cde281870 100644
+--- a/validator/val_sigcrypt.c
++++ b/validator/val_sigcrypt.c
+@@ -1094,6 +1094,7 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
+ 	size_t len)
+ {
+ 	uint8_t* datstart = sldns_buffer_current(buf)-len+2;
++	size_t firstlen;
+ 	switch(ntohs(rrset->rk.type)) {
+ 		case LDNS_RR_TYPE_NXT: 
+ 		case LDNS_RR_TYPE_NS:
+@@ -1113,8 +1114,9 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
+ 		case LDNS_RR_TYPE_SOA:
+ 			/* two names after another */
+ 			query_dname_tolower(datstart);
+-			query_dname_tolower(datstart + 
+-				dname_valid(datstart, len-2));
++			firstlen = dname_valid(datstart, len-2);
++			if(firstlen && firstlen < len-2)
++				query_dname_tolower(datstart + firstlen);
+ 			return;
+ 		case LDNS_RR_TYPE_RT:
+ 		case LDNS_RR_TYPE_AFSDB:
+@@ -1141,8 +1143,9 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
+ 				return;
+ 			datstart += 2;
+ 			query_dname_tolower(datstart);
+-			query_dname_tolower(datstart + 
+-				dname_valid(datstart, len-2-2));
++			firstlen = dname_valid(datstart, len-2-2);
++			if(firstlen && firstlen < len-2-2)
++				query_dname_tolower(datstart + firstlen);
+ 			return;
+ 		case LDNS_RR_TYPE_NAPTR:
+ 			if(len < 2+4)
diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
index af848988aa..516ea20654 100644
--- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
@@ -41,6 +41,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
            file://CVE-2026-55973.patch \
            file://CVE-2026-55990.patch \
            file://CVE-2026-55991.patch \
+           file://CVE-2026-56416.patch \
            "
 
 SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"