new file mode 100644
@@ -0,0 +1,83 @@
+From 97caf75e44191118fcb678f95fca15d3ea2a074f Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 20 May 2026 10:18:23 +0200
+Subject: [PATCH] - Fix CVE-2026-41292, Parsing a long list of incoming EDNS
+ options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan
+ Zhang from Palo Alto Networks, for the report.
+
+(cherry picked from commit ef5ca84360934fa1e857ebc371d4b093aea6355d)
+
+CVE: CVE-2026-41292
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/ef5ca84360934fa1e857ebc371d4b093aea6355d]
+
+Dropped changes to the Changelog file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ util/data/msgparse.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/util/data/msgparse.c b/util/data/msgparse.c
+index 2d0955631..169709b7e 100644
+--- a/util/data/msgparse.c
++++ b/util/data/msgparse.c
+@@ -53,6 +53,8 @@
+ #include "sldns/parseutil.h"
+ #include "sldns/wire2str.h"
+
++#define MAX_PARSED_EDNS_OPTIONS 100
++
+ /** smart comparison of (compressed, valid) dnames from packet */
+ static int
+ smart_compare(sldns_buffer* pkt, uint8_t* dnow,
+@@ -950,7 +952,7 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
+ struct comm_reply* repinfo, uint32_t now, struct regional* region,
+ struct cookie_secrets* cookie_secrets)
+ {
+- int nsid_seen = 0, cookie_seen = 0, padding_seen = 0;
++ int i = 0, nsid_seen = 0, cookie_seen = 0, padding_seen = 0;
+ /* To respond with a Keepalive option, the client connection must have
+ * received one message with a TCP Keepalive EDNS option, and that
+ * option must have 0 length data. Subsequent messages sent on that
+@@ -970,7 +972,7 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
+
+ /* while still more options, and have code+len to read */
+ /* ignores partial content (i.e. rdata len 3) */
+- while(rdata_len >= 4) {
++ while(rdata_len >= 4 && i < MAX_PARSED_EDNS_OPTIONS) {
+ uint16_t opt_code = sldns_read_uint16(rdata_ptr);
+ uint16_t opt_len = sldns_read_uint16(rdata_ptr+2);
+ uint8_t server_cookie[40];
+@@ -1150,6 +1152,7 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
+ }
+ rdata_ptr += opt_len;
+ rdata_len -= opt_len;
++ i++;
+ }
+ return LDNS_RCODE_NOERROR;
+ }
+@@ -1164,6 +1167,7 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg,
+ struct rrset_parse* found_prev = 0;
+ size_t rdata_len;
+ uint8_t* rdata_ptr;
++ int i = 0;
+ /* since the class encodes the UDP size, we cannot use hash table to
+ * find the EDNS OPT record. Scan the packet. */
+ while(rrset) {
+@@ -1223,7 +1227,7 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg,
+
+ /* while still more options, and have code+len to read */
+ /* ignores partial content (i.e. rdata len 3) */
+- while(rdata_len >= 4) {
++ while(rdata_len >= 4 && i < MAX_PARSED_EDNS_OPTIONS) {
+ uint16_t opt_code = sldns_read_uint16(rdata_ptr);
+ uint16_t opt_len = sldns_read_uint16(rdata_ptr+2);
+ rdata_ptr += 4;
+@@ -1238,6 +1242,7 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg,
+ }
+ rdata_ptr += opt_len;
+ rdata_len -= opt_len;
++ i++;
+ }
+ /* ignore rrsigs */
+ return LDNS_RCODE_NOERROR;
@@ -17,6 +17,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-42959.patch \
file://CVE-2026-32792.patch \
file://CVE-2026-40622.patch \
+ file://CVE-2026-41292.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"