unbound: patch CVE-2026-55708

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55708

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-networking/recipes-support/unbound/unbound/CVE-2026-55708.patch

@@ -0,0 +1,51 @@
+From 1138101d9147db0539c27e9c19525223f32de84c Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 22 Jul 2026 10:17:10 +0200
+Subject: [PATCH] - Fix CVE-2026-55708, Privacy/configuration issue when adding
+ local   data in views through 'unbound-control'. Thanks to Qifan Zhang,  
+ Palo Alto Networks, for the report.
+
+(cherry picked from commit c29ff70f6aa9bb2f02e5f21001832f2b4791bd76)
+
+CVE: CVE-2026-55708
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/c29ff70f6aa9bb2f02e5f21001832f2b4791bd76]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ daemon/remote.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/daemon/remote.c b/daemon/remote.c
+index d8ee7fa7d..8a26dadc7 100644
+--- a/daemon/remote.c
++++ b/daemon/remote.c
+@@ -1634,6 +1634,14 @@ do_view_data_add(RES* ssl, struct worker* worker, char* arg)
+ 			ssl_printf(ssl,"error out of memory\n");
+ 			return;
+ 		}
++		if(!v->isfirst) {
++			/* Global local-zone is not used for this view,
++			 * therefore add defaults to this view-specific
++			 * local-zone. */
++			struct config_file lz_cfg;
++			memset(&lz_cfg, 0, sizeof(lz_cfg));
++			local_zone_enter_defaults(v->local_zones, &lz_cfg);
++		}
+ 	}
+ 	do_data_add(ssl, v->local_zones, arg2);
+ 	lock_rw_unlock(&v->lock);
+@@ -1659,6 +1667,14 @@ do_view_datas_add(struct daemon_remote* rc, RES* ssl, struct worker* worker,
+ 			ssl_printf(ssl,"error out of memory\n");
+ 			return;
+ 		}
++		if(!v->isfirst) {
++			/* Global local-zone is not used for this view,
++			 * therefore add defaults to this view-specific
++			 * local-zone. */
++			struct config_file lz_cfg;
++			memset(&lz_cfg, 0, sizeof(lz_cfg));
++			local_zone_enter_defaults(v->local_zones, &lz_cfg);
++		}
+ 	}
+ 	/* put the view name in the command buf */
+ 	(void)snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "%s ", arg);

meta-networking/recipes-support/unbound/unbound_1.24.2.bb

@@ -36,6 +36,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
            file://CVE-2026-50252.patch \
            file://CVE-2026-52863.patch \
            file://CVE-2026-54478.patch \
+           file://CVE-2026-55708.patch \
            "
 
 SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"