diff --git a/download b/download
index 7cb5494dd163d59b479a8bbb7ece5f5b1252ea7e..3a2ebe4a537b5a7616da30993092c98d91ad91e1 100644
--- a/download
+++ b/download
@@ -1 +1 @@
-e0cb61cbf6e1144c452368c4535ae931  mysql-boost-8.0.37.tar.gz
+8a3ce5a136cebbe7fe5d8e122afffd30  mysql-boost-8.0.40.tar.gz
diff --git a/mysql-mtr.patch b/mysql-mtr.patch
index 1e56b932b48703bd088fb923a396c36449fedf13..34bd70cebf3b7d6234aabcf1d1328f32334fc02c 100644
--- a/mysql-mtr.patch
+++ b/mysql-mtr.patch
@@ -104,7 +104,7 @@ index f50573a9..82488df1 100755
 -  # UNIX domain socket's path far below PATH_MAX. Don't allow that
 -  # to happen.
 -  my $res =
--    check_socket_path_length("$opt_tmpdir/mysqld.NN.sock", $opt_parallel);
+-    check_socket_path_length("$opt_tmpdir/mysqld.NN.sock", $opt_parallel, $tmpdir_path_updated);
 -  if ($res) {
 -    mtr_error("Socket path '$opt_tmpdir' too long, it would be ",
 -              "truncated and thus not possible to use for connection to ",
diff --git a/mysql.spec b/mysql.spec
index dfb82d2531ebd6f6b2208d1ca3bc8aed0f9f3b90..a070018e12f0bf040b79e55aa2b26939372f1c48 100644
--- a/mysql.spec
+++ b/mysql.spec
@@ -75,7 +75,7 @@
 %global sameevr   %{?epoch:%{epoch}:}%{version}-%{release}
 
 Name:             mysql
-Version:          8.0.37
+Version:          8.0.40
 Release:          %{anolis_release}%{?dist}
 Summary:          MySQL client programs and shared libraries
 URL:              http://www.mysql.com
@@ -376,7 +376,7 @@ pushd boost/boost_$(echo %{boost_bundled_version}| tr . _)
 %patch111 -p1
 %patch112 -p1
 popd
-%patch113 -p1
+#%patch113 -p1
 #%patch114 -p1
 
 # generate a list of tests that fail, but are not disabled by upstream
@@ -931,6 +931,11 @@ fi
 %endif
 
 %changelog
+* Tue Jan 14 2025 yangxinyu <yangxinyu@nfschina.com> - 8.0.40-1
+- update to 8.0.40
+- fix CVE-2024-21198
+- fix CVE-2024-21203
+
 * Fri May 31 2024 Kaiqiang Wang <wangkaiqiang@inspur.com> - 8.0.37-1
 - update to 8.0.37
 - fix CVE-2024-21096