diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-41292.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-41292.patch
new file mode 100644
index 0000000000..8ca3ec2716
--- /dev/null
+++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-41292.patch
@@ -0,0 +1,83 @@
+From 97caf75e44191118fcb678f95fca15d3ea2a074f Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 20 May 2026 10:18:23 +0200
+Subject: [PATCH] - Fix CVE-2026-41292, Parsing a long list of incoming EDNS
+ options   degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan 
+  Zhang from Palo Alto Networks, for the report.
+
+(cherry picked from commit ef5ca84360934fa1e857ebc371d4b093aea6355d)
+
+CVE: CVE-2026-41292
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/ef5ca84360934fa1e857ebc371d4b093aea6355d]
+
+Dropped changes to the Changelog file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ util/data/msgparse.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/util/data/msgparse.c b/util/data/msgparse.c
+index 2d0955631..169709b7e 100644
+--- a/util/data/msgparse.c
++++ b/util/data/msgparse.c
+@@ -53,6 +53,8 @@
+ #include "sldns/parseutil.h"
+ #include "sldns/wire2str.h"
+ 
++#define MAX_PARSED_EDNS_OPTIONS 100
++
+ /** smart comparison of (compressed, valid) dnames from packet */
+ static int
+ smart_compare(sldns_buffer* pkt, uint8_t* dnow, 
+@@ -950,7 +952,7 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
+ 	struct comm_reply* repinfo, uint32_t now, struct regional* region,
+ 	struct cookie_secrets* cookie_secrets)
+ {
+-	int nsid_seen = 0, cookie_seen = 0, padding_seen = 0;
++	int i = 0, nsid_seen = 0, cookie_seen = 0, padding_seen = 0;
+ 	/* To respond with a Keepalive option, the client connection must have
+ 	 * received one message with a TCP Keepalive EDNS option, and that
+ 	 * option must have 0 length data. Subsequent messages sent on that
+@@ -970,7 +972,7 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
+ 
+ 	/* while still more options, and have code+len to read */
+ 	/* ignores partial content (i.e. rdata len 3) */
+-	while(rdata_len >= 4) {
++	while(rdata_len >= 4 && i < MAX_PARSED_EDNS_OPTIONS) {
+ 		uint16_t opt_code = sldns_read_uint16(rdata_ptr);
+ 		uint16_t opt_len = sldns_read_uint16(rdata_ptr+2);
+ 		uint8_t server_cookie[40];
+@@ -1150,6 +1152,7 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
+ 		}
+ 		rdata_ptr += opt_len;
+ 		rdata_len -= opt_len;
++		i++;
+ 	}
+ 	return LDNS_RCODE_NOERROR;
+ }
+@@ -1164,6 +1167,7 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg,
+ 	struct rrset_parse* found_prev = 0;
+ 	size_t rdata_len;
+ 	uint8_t* rdata_ptr;
++	int i = 0;
+ 	/* since the class encodes the UDP size, we cannot use hash table to
+ 	 * find the EDNS OPT record. Scan the packet. */
+ 	while(rrset) {
+@@ -1223,7 +1227,7 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg,
+ 
+ 	/* while still more options, and have code+len to read */
+ 	/* ignores partial content (i.e. rdata len 3) */
+-	while(rdata_len >= 4) {
++	while(rdata_len >= 4 && i < MAX_PARSED_EDNS_OPTIONS) {
+ 		uint16_t opt_code = sldns_read_uint16(rdata_ptr);
+ 		uint16_t opt_len = sldns_read_uint16(rdata_ptr+2);
+ 		rdata_ptr += 4;
+@@ -1238,6 +1242,7 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg,
+ 		}
+ 		rdata_ptr += opt_len;
+ 		rdata_len -= opt_len;
++		i++;
+ 	}
+ 	/* ignore rrsigs */
+ 	return LDNS_RCODE_NOERROR;
diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
index 1c9a7fa489..0688b8a78b 100644
--- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
@@ -17,6 +17,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
            file://CVE-2026-42959.patch \
            file://CVE-2026-32792.patch \
            file://CVE-2026-40622.patch \
+           file://CVE-2026-41292.patch \
            "
 
 SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"