diff --git a/fix-CVE-2026-63383.patch b/fix-CVE-2026-63383.patch
new file mode 100644
index 0000000000000000000000000000000000000000..76c4e8a3dc30b071332db6e9e2ad62af90a61520
--- /dev/null
+++ b/fix-CVE-2026-63383.patch
@@ -0,0 +1,37 @@
+From 91ed8745eebabdd27592a83d350338a8c4626321 Mon Sep 17 00:00:00 2001
+From: Nick Mathewson <nickm@torproject.org>
+Date: Wed, 24 Jun 2026 09:53:23 -0400
+Subject: [PATCH] evrpc: Fix out-of-bounds read in decode_tag_internal
+
+This bug could allow an attacker to cause an evrpc client or server
+to read out of bounds when decoding a tag.
+
+Fixes GHSA-fj29-64w6-73h6.
+
+Reported by @Brubbish.
+
+Tracking: X5.
+---
+ event_tagging.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/event_tagging.c b/event_tagging.c
+index 790dff3c2..9ee642bb2 100644
+--- a/event_tagging.c
++++ b/event_tagging.c
+@@ -210,12 +210,13 @@ decode_tag_internal(ev_uint32_t *ptag, struct evbuffer *evbuf, int dodrain)
+ 	 * the encoding of a number is at most one byte more than its
+ 	 * storage size.  however, it may also be much smaller.
+ 	 */
++	size_t pullup_len = len < sizeof(number) + 1 ? len : sizeof(number) + 1;
+ 	data = evbuffer_pullup(
+-		evbuf, len < sizeof(number) + 1 ? len : sizeof(number) + 1);
++		evbuf, pullup_len);
+ 	if (!data)
+ 		return (-1);
+ 
+-	while (count++ < len) {
++	while (count++ < pullup_len) {
+ 		ev_uint8_t lower = *data++;
+ 		if (shift >= 28) {
+ 			/* Make sure it fits into 32 bits */
diff --git a/libevent.spec b/libevent.spec
index 4e8e16eafce970139538fc9c2d801ea986ac303a..dac4066fc6f88ed6e7e8f138c3201c9025f544c8 100644
--- a/libevent.spec
+++ b/libevent.spec
@@ -1,6 +1,6 @@
 %global develdocdir %{_docdir}/%{name}-devel
 
-%define anolis_release 5
+%define anolis_release 6
 Name:           libevent
 Version:        2.1.12
 Release:        %{anolis_release}%{?dist}
@@ -30,6 +30,8 @@ Patch03: 0003-build-add-doxygen-to-all.patch
 
 # https://github.com/libevent/libevent/commit/377b9022c3ac61aa4540b5dc4b70c60bf74c663d.patch
 Patch0004: 0004-bugfix-for-CVE-2026-63387.patch
+# https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321
+Patch0005: fix-CVE-2026-63383.patch
 
 %description
 The libevent API provides a mechanism to execute a callback function
@@ -64,6 +66,7 @@ This package contains the development documentation for %{name}.
 %patch02 -p1 -b .fix-install
 %patch03 -p1 -b .fix-install-2
 %patch0004 -p1 -b .0004-bugfix-for-CVE-2026-63387
+%patch0005 -p1 -b .fix-CVE-2026-63383
 
 pathfix.py -i %{__python3} -pn test/check-dumpevents.py \
                                event_rpcgen.py
@@ -150,6 +153,9 @@ mkdir -p $RPM_BUILD_ROOT/%{develdocdir}/sample
 %doc %{develdocdir}/
 
 %changelog
+* Tue Sep 01 2026 ali-inspur <shenzhongli@inspur.com> - 2.1.12-6
+- Fix CVE-2026-63383
+
 * Mon Aug 24 2026 tomcruiseqi <tomcruiseqi@inspur.com> - 2.1.12-5
 - Fix CVE-2026-63387