diff --git a/unbound-1.26.0-CVE-2026-50252-fix1.patch b/unbound-1.26.0-CVE-2026-50252-fix1.patch
new file mode 100644
index 0000000..ed4df89
--- /dev/null
+++ b/unbound-1.26.0-CVE-2026-50252-fix1.patch
@@ -0,0 +1,61 @@
+From a04694c76fc0d9232b1081ad8662809d9211ff85 Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Fri, 24 Jul 2026 12:13:09 +0200
+Subject: [PATCH] - Fix lock test protect for auth zone change. - Fix to lock
+ shared_ports structure during initialisation. - Fix to lock anchor structure
+ when file is set for it in
+
+(cherry picked from commit e597711824e3050fe789f1388766ec5e662684d2)
+---
+ unbound-1.16.2/services/authzone.c        | 7 ++++++-
+ unbound-1.16.2/services/outside_network.c | 7 ++++++-
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/unbound-1.16.2/services/authzone.c b/unbound-1.16.2/services/authzone.c
+index cfab17bc0..105391060 100644
+--- a/unbound-1.16.2/services/authzone.c
++++ b/unbound-1.16.2/services/authzone.c
+@@ -432,7 +432,12 @@ auth_zone_create(struct auth_zones* az, uint8_t* nm, size_t nmlen,
+ 	rbtree_init(&z->data, &auth_data_cmp);
+ 	lock_rw_init(&z->lock);
+ 	lock_protect(&z->lock, &z->name, sizeof(*z)-sizeof(rbnode_type)-
+-			sizeof(&z->rpz_az_next)-sizeof(&z->rpz_az_prev));
++			sizeof(z->rpz_az_next)-sizeof(z->rpz_az_prev)-
++			sizeof(z->max_transfer_size)-sizeof(z->max_transfer_size));
++	lock_protect(&z->lock, &z->max_transfer_size,
++		sizeof(z->max_transfer_size));
++	lock_protect(&z->lock, &z->max_transfer_time,
++		sizeof(z->max_transfer_time));
+ 	lock_rw_wrlock(&z->lock);
+ 	/* z lock protects all, except rbtree itself and the rpz linked list
+ 	 * pointers, which are protected using az->lock */
+diff --git a/unbound-1.16.2/services/outside_network.c b/unbound-1.16.2/services/outside_network.c
+index 3b9ca68cd..86956fbed 100644
+--- a/unbound-1.16.2/services/outside_network.c
++++ b/unbound-1.16.2/services/outside_network.c
+@@ -3970,16 +3970,21 @@ struct shared_ports* shared_ports_create(char** ifs, int num_ifs, int do_ip4,
+ 		return NULL;
+ 	}
+ 	lock_basic_init(&shp->lock);
+-	lock_protect(&shp->lock, shp, sizeof(*shp));
++	lock_protect(&shp->lock, &shp->ip4_ifs, sizeof(shp->ip4_ifs));
++	lock_protect(&shp->lock, &shp->num_ip4, sizeof(shp->num_ip4));
++	lock_protect(&shp->lock, &shp->ip6_ifs, sizeof(shp->ip6_ifs));
++	lock_protect(&shp->lock, &shp->num_ip6, sizeof(shp->num_ip6));
+ 
+ #ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
+ 	/* Allocate interfaces */
++	lock_basic_lock(&shp->lock);
+ 	if(!shared_ports_alloc_ifs(shp, ifs, num_ifs, do_ip4, do_ip6,
+ 		availports, numavailports)) {
+ 		log_err("malloc failed");
+ 		shared_ports_delete(shp);
+ 		return NULL;
+ 	}
++	lock_basic_unlock(&shp->lock);
+ #else
+ 	(void)ifs; (void)num_ifs; (void)do_ip4; (void)do_ip6;
+ 	(void)availports; (void)numavailports;
+-- 
+2.55.0
+
diff --git a/unbound.spec b/unbound.spec
index be19086..92421c0 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -34,7 +34,7 @@
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
 Version: 1.16.2
-Release: 5.14%{?extra_version:.%{extra_version}}%{?dist}.1
+Release: 5.14%{?extra_version:.%{extra_version}}%{?dist}.2
 License: BSD
 Url: https://www.unbound.net/
 Source: https://www.unbound.net/downloads/%{name}-%{version}%{?extra_version}.tar.gz
@@ -98,6 +98,8 @@ Patch15: unbound-1.25.2-CVE-2026-44690.patch
 Patch16: unbound-1.25.2-CVE-2026-44690-test.patch
 # https://github.com/NLnetLabs/unbound/commit/804cff4c152a121961b04605f75132370fc80df4
 Patch17: unbound-1.25.2-CVE-2026-50252.patch
+# https://github.com/NLnetLabs/unbound/commit/e597711824e3050fe789f1388766ec5e662684d2
+Patch18: unbound-1.26.0-CVE-2026-50252-fix1.patch
 
 
 BuildRequires: gdb
@@ -215,6 +217,7 @@ pushd %{pkgname}
 %patch15 -p1 -b .CVE-2026-44690
 %patch16 -p1 -b .CVE-2026-44690-test
 %patch17 -p1 -b .CVE-2026-50252
+%patch18 -p2 -b .CVE-2026-50252-fix1
 
 # copy common doc files - after here, since it may be patched
 cp -pr doc pythonmod libunbound ../
@@ -481,6 +484,9 @@ popd
 %verify(not md5 size mtime) %{_sharedstatedir}/%{name}/root.key
 
 %changelog
+* Wed Aug 19 2026 Petr Menšík <pemensik@redhat.com> - 1.16.2-5.14.2
+- Backport additional fix from 1.26.0 (CVE-2026-50252)
+
 * Wed Aug 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.2-5.14.1
 - Fix CVE-2026-50252 (cache poisoning via source port prediction)