From 417777608a4293891ecd9c82826fee63a4acf054 Mon Sep 17 00:00:00 2001
From: Fedor Vorobev <fvorobev@redhat.com>
Date: Mon, 25 May 2026 17:07:49 +0200
Subject: [PATCH] Fix CVE-2026-42944

Resolves-Vulnerability: CVE-2026-42944
Resolves: RHEL-177909
---
 unbound-1.25.1-CVE-2026-42944.patch | 34 +++++++++++++++++++++++++++++
 unbound.spec                        | 10 +++++++--
 2 files changed, 42 insertions(+), 2 deletions(-)
 create mode 100644 unbound-1.25.1-CVE-2026-42944.patch

diff --git a/unbound-1.25.1-CVE-2026-42944.patch b/unbound-1.25.1-CVE-2026-42944.patch
new file mode 100644
index 0000000..4853f88
--- /dev/null
+++ b/unbound-1.25.1-CVE-2026-42944.patch
@@ -0,0 +1,34 @@
+diff --git a/unbound-1.16.2/util/data/msgparse.c b/unbound-1.16.2/util/data/msgparse.c
+index 5bb69d6..7a51441 100644
+--- a/unbound-1.16.2/util/data/msgparse.c
++++ b/unbound-1.16.2/util/data/msgparse.c
+@@ -957,6 +957,7 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
+ 	struct edns_data* edns, struct config_file* cfg, struct comm_point* c,
+ 	struct regional* region)
+ {
++	int nsid_seen = 0, padding_seen = 0;
+ 	/* To respond with a Keepalive option, the client connection must have
+ 	 * received one message with a TCP Keepalive EDNS option, and that
+ 	 * option must have 0 length data. Subsequent messages sent on that
+@@ -987,8 +988,9 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
+ 		/* handle parse time edns options here */
+ 		switch(opt_code) {
+ 		case LDNS_EDNS_NSID:
+-			if (!cfg || !cfg->nsid)
++			if (!cfg || !cfg->nsid || nsid_seen)
+ 				break;
++			nsid_seen = 1;
+ 			if(!edns_opt_list_append(&edns->opt_list_out,
+ 						LDNS_EDNS_NSID, cfg->nsid_len,
+ 						cfg->nsid, region)) {
+@@ -1030,8 +1032,9 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
+ 
+ 		case LDNS_EDNS_PADDING:
+ 			if(!cfg || !cfg->pad_responses ||
+-					!c || c->type != comm_tcp ||!c->ssl)
++					!c || c->type != comm_tcp ||!c->ssl || padding_seen)
+ 				break;
++			padding_seen = 1;
+ 			if(!edns_opt_list_append(&edns->opt_list_out,
+ 						LDNS_EDNS_PADDING,
+ 						0, NULL, region)) {
diff --git a/unbound.spec b/unbound.spec
index 2fe66ca..f86be70 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -34,7 +34,7 @@
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
 Version: 1.16.2
-Release: 5.10%{?extra_version:.%{extra_version}}%{?dist}
+Release: 5.11%{?extra_version:.%{extra_version}}%{?dist}
 License: BSD
 Url: https://www.unbound.net/
 Source: https://www.unbound.net/downloads/%{name}-%{version}%{?extra_version}.tar.gz
@@ -78,6 +78,9 @@ Patch5: unbound-1.21-CVE-2024-8508.patch
 Patch6: unbound-1.23.1-CVE-2025-5994.patch
 # https://github.com/NLnetLabs/unbound/commit/f094f4ea3c943c5b5b2b6fa8bee0e7a8f3cfdc51
 Patch7: unbound-1.20-unbound-anchor-key-38696.patch
+# https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-42944.diff
+Patch8: unbound-1.25.1-CVE-2026-42944.patch
+
 
 BuildRequires: gdb
 BuildRequires: gcc, make
@@ -184,7 +187,7 @@ pushd %{pkgname}
 %patch5 -p2 -b .CVE-2024-8508
 %patch6 -p2 -b .CVE-2025-5994
 %patch7 -p2 -b .dnssec-ta-2024
-
+%patch8 -p2 -b .CVE-2026-42944
 
 # copy common doc files - after here, since it may be patched
 cp -pr doc pythonmod libunbound ../
@@ -451,6 +454,9 @@ popd
 %verify(not md5 size mtime) %{_sharedstatedir}/%{name}/root.key
 
 %changelog
+* Mon May 25 2026 Fedor Vorobev <fvorobev@redhat.com> - 1.16.2-5.11
+- Fix CVE-2026-42944 (RHEL‑177909)
+
 * Tue Nov 11 2025 Petr Menšík <pemensik@redhat.com> - 1.16.2-5.10
 - Add new root key 38696 (RHEL-131172)
 - Update unbound-anchor built-in dnssec key