new file mode 100644
@@ -0,0 +1,70 @@
+From 0d649a36fd3c47f1b75ca90ce10e52cb4ae3d253 Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 20 May 2026 10:19:08 +0200
+Subject: [PATCH] - Fix CVE-2026-42534, Jostle logic bypass degrades resolution
+ performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+
+(cherry picked from commit a794c87578c963606a6fb00a54c46fcf935f519a)
+
+CVE: CVE-2026-42534
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/a794c87578c963606a6fb00a54c46fcf935f519a]
+
+Dropped changes to the Changelog file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ services/mesh.c | 14 ++++++++++----
+ services/mesh.h | 6 ++++++
+ 2 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/services/mesh.c b/services/mesh.c
+index 3212a6abf..23499dcef 100644
+--- a/services/mesh.c
++++ b/services/mesh.c
+@@ -296,12 +296,14 @@ int mesh_make_new_space(struct mesh_area* mesh, sldns_buffer* qbuf)
+ if(mesh->num_reply_states < mesh->max_reply_states)
+ return 1;
+ /* try to kick out a jostle-list item */
+- if(m && m->reply_list && m->list_select == mesh_jostle_list) {
++ if(m && m->list_select == mesh_jostle_list) {
+ /* how old is it? */
+ struct timeval age;
+- timeval_subtract(&age, mesh->env->now_tv,
+- &m->reply_list->start_time);
+- if(timeval_smaller(&mesh->jostle_max, &age)) {
++ if(m->has_first_reply_time)
++ timeval_subtract(&age, mesh->env->now_tv,
++ &m->first_reply_time);
++ if(!m->has_first_reply_time ||
++ timeval_smaller(&mesh->jostle_max, &age)) {
+ /* its a goner */
+ log_nametypeclass(VERB_ALGO, "query jostled out to "
+ "make space for a new one",
+@@ -1960,6 +1962,10 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
+ r->qid = qid;
+ r->qflags = qflags;
+ r->start_time = *s->s.env->now_tv;
++ if(s->reply_list == NULL && !s->has_first_reply_time) {
++ s->first_reply_time = r->start_time;
++ s->has_first_reply_time = 1;
++ }
+ r->next = s->reply_list;
+ r->qname = regional_alloc_init(s->s.region, qinfo->qname,
+ s->s.qinfo.qname_len);
+diff --git a/services/mesh.h b/services/mesh.h
+index f19f423a8..a61f90993 100644
+--- a/services/mesh.h
++++ b/services/mesh.h
+@@ -189,6 +189,12 @@ struct mesh_state {
+ struct module_qstate s;
+ /** the list of replies to clients for the results */
+ struct mesh_reply* reply_list;
++ /** if it has a first reply time */
++ int has_first_reply_time;
++ /** wall-clock time the first client reply was attached;
++ * used by mesh_make_new_space() so duplicate retransmits
++ * cannot reset jostle aging. */
++ struct timeval first_reply_time;
+ /** the list of callbacks for the results */
+ struct mesh_cb* cb_list;
+ /** set of superstates (that want this state's result)
@@ -18,6 +18,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-32792.patch \
file://CVE-2026-40622.patch \
file://CVE-2026-41292.patch \
+ file://CVE-2026-42534.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"