diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-50046.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-50046.patch
new file mode 100644
index 0000000000..018a61cf54
--- /dev/null
+++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-50046.patch
@@ -0,0 +1,61 @@
+From 513f5e4be89d3b139605dfc31c3fb3728f25be2a Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 22 Jul 2026 10:13:36 +0200
+Subject: [PATCH] - Fix CVE-2026-50046, Possible heap use-after-free in an
+ error path   when a DoT forwarded query is jostled out. Thanks to Qifan
+ Zhang,   Palo Alto Networks, for the report.
+
+(cherry picked from commit 1ad8d4c39594dcb28d636fb4922737a3640c9a65)
+
+CVE: CVE-2026-50046
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/1ad8d4c39594dcb28d636fb4922737a3640c9a65]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ services/outside_network.c | 12 +++++++++++-
+ services/outside_network.h |  2 +-
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/services/outside_network.c b/services/outside_network.c
+index 2b7f7d0a2..bc65d36f7 100644
+--- a/services/outside_network.c
++++ b/services/outside_network.c
+@@ -195,6 +195,7 @@ static void
+ waiting_tcp_delete(struct waiting_tcp* w)
+ {
+ 	if(!w) return;
++	free(w->tls_auth_name);
+ 	if(w->timer)
+ 		comm_timer_delete(w->timer);
+ 	free(w);
+@@ -2489,7 +2490,16 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
+ 	w->cb = callback;
+ 	w->cb_arg = callback_arg;
+ 	w->ssl_upstream = sq->ssl_upstream;
+-	w->tls_auth_name = sq->tls_auth_name;
++	if(sq->tls_auth_name) {
++		w->tls_auth_name = strdup(sq->tls_auth_name);
++		if(!w->tls_auth_name) {
++			comm_timer_delete(w->timer);
++			free(w);
++			return NULL;
++		}
++	} else {
++		w->tls_auth_name = NULL;
++	}
+ 	w->timeout = timeout;
+ 	w->id_node.key = NULL;
+ 	w->write_wait_prev = NULL;
+diff --git a/services/outside_network.h b/services/outside_network.h
+index 0a77e3388..81ebfe3e2 100644
+--- a/services/outside_network.h
++++ b/services/outside_network.h
+@@ -412,7 +412,7 @@ struct waiting_tcp {
+ 	void* cb_arg;
+ 	/** if it uses ssl upstream */
+ 	int ssl_upstream;
+-	/** ref to the tls_auth_name from the serviced_query */
++	/** owned copy of the tls_auth_name (malloced) */
+ 	char* tls_auth_name;
+ 	/** the packet was involved in an error, to stop looping errors */
+ 	int error_count;
diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
index 28214dea19..cc380f6ae0 100644
--- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
@@ -29,6 +29,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
            file://CVE-2026-44621.patch \
            file://CVE-2026-44687.patch \
            file://CVE-2026-50045.patch \
+           file://CVE-2026-50046.patch \
            "
 
 SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"