Fix CVE-2026-50252: prevent cache poisoning via shared ports

Backport fix for CVE-2026-50252 from upstream commit
804cff4c to unbound-1.16.2. The patch introduces a shared_ports
structure with per-thread source port population mapping and
proper locking, preventing cache poisoning attacks through
source port prediction.

CVE: CVE-2026-50252
Upstream patches:
 - 804cff4c15.patch
Resolves: RHEL-243471

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

unbound.spec

@@ -34,7 +34,7 @@
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
 Version: 1.16.2
-Release: 5.14%{?extra_version:.%{extra_version}}%{?dist}
+Release: 5.14%{?extra_version:.%{extra_version}}%{?dist}.1
 License: BSD
 Url: https://www.unbound.net/
 Source: https://www.unbound.net/downloads/%{name}-%{version}%{?extra_version}.tar.gz
@@ -96,6 +96,8 @@ Patch14: unbound-1.25.1-CVE-2026-42534.patch
 Patch15: unbound-1.25.2-CVE-2026-44690.patch
 # https://github.com/NLnetLabs/unbound/commit/3d5e6c06923eff9eac2f5e31a69c43a15ca9d3c2
 Patch16: unbound-1.25.2-CVE-2026-44690-test.patch
+# https://github.com/NLnetLabs/unbound/commit/804cff4c152a121961b04605f75132370fc80df4
+Patch17: unbound-1.25.2-CVE-2026-50252.patch
 
 
 BuildRequires: gdb
@@ -212,6 +214,7 @@ pushd %{pkgname}
 %patch14 -p2 -b .CVE-2026-42534
 %patch15 -p1 -b .CVE-2026-44690
 %patch16 -p1 -b .CVE-2026-44690-test
+%patch17 -p1 -b .CVE-2026-50252
 
 # copy common doc files - after here, since it may be patched
 cp -pr doc pythonmod libunbound ../
@@ -478,6 +481,9 @@ popd
 %verify(not md5 size mtime) %{_sharedstatedir}/%{name}/root.key
 
 %changelog
+* Wed Aug 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.2-5.14.1
+- Fix CVE-2026-50252 (cache poisoning via source port prediction)
+
 * Wed Aug 05 2026 Fedor Vorobev <fvorobev@redhat.com> - 1.16.2-5.14
 - Add unit test for CVE-2026-44690 from upstream.