diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index b92fb23d64e5..feb3298c5ba7 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , openssl
 , nettle
 , expat
@@ -107,6 +108,16 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  patches = [
+    # Fix CVE-2022-30698 and CVE-2022-30699
+    (fetchpatch {
+      url = "https://github.com/NLnetLabs/unbound/commit/f6753a0f1018133df552347a199e0362fc1dac68.patch";
+      name = "CVE-2022-30698.CVE-2022-30699.patch";
+      hash = "sha256-tLHkQoAbtYqLr3ASYfYX6pGtjD2TWT4B5NUubT4EN90=";
+      excludes = [ "doc/Changelog" ];
+    })
+  ];
+
   postPatch = lib.optionalString withPythonModule ''
     substituteInPlace Makefile.in \
       --replace "\$(DESTDIR)\$(PYTHON_SITE_PKG)" "$out/${python.sitePackages}"
diff --git a/pkgs/tools/networking/unbound/python.nix b/pkgs/tools/networking/unbound/python.nix
index 067f5d2b417b..8acd6ff04417 100644
--- a/pkgs/tools/networking/unbound/python.nix
+++ b/pkgs/tools/networking/unbound/python.nix
@@ -5,7 +5,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "pyunbound";
-  inherit (unbound) version src;
+  inherit (unbound) version src patches;
 
   nativeBuildInputs = [ swig ];