diff --git a/0001-upstream-Fix-logic-error-in-DisableForwarding-option.patch b/0001-upstream-Fix-logic-error-in-DisableForwarding-option.patch
new file mode 100644
index 0000000000000000000000000000000000000000..a457b758d3a8e85c812bc2f1379dbeab6479f00f
--- /dev/null
+++ b/0001-upstream-Fix-logic-error-in-DisableForwarding-option.patch
@@ -0,0 +1,40 @@
+From fc86875e6acb36401dfc1dfb6b628a9d1460f367 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 9 Apr 2025 07:00:03 +0000
+Subject: [PATCH] upstream: Fix logic error in DisableForwarding option. This
+ option
+
+was documented as disabling X11 and agent forwarding but it failed to do so.
+Spotted by Tim Rice.
+
+OpenBSD-Commit-ID: fffc89195968f7eedd2fc57f0b1f1ef3193f5ed1
+---
+ session.c | 5 ++++---
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/session.c b/session.c
+index 52a4a3446..6444c77f3 100644
+--- a/session.c
++++ b/session.c
+@@ -2171,7 +2171,8 @@ session_auth_agent_req(struct ssh *ssh, Session *s)
+ 	if ((r = sshpkt_get_end(ssh)) != 0)
+ 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
+ 	if (!auth_opts->permit_agent_forwarding_flag ||
+-	    !options.allow_agent_forwarding) {
++	    !options.allow_agent_forwarding ||
++	    options.disable_forwarding) {
+ 		debug_f("agent forwarding disabled");
+ 		return 0;
+ 	}
+@@ -2566,7 +2567,7 @@ session_setup_x11fwd(struct ssh *ssh, Session *s)
+ 		ssh_packet_send_debug(ssh, "X11 forwarding disabled by key options.");
+ 		return 0;
+ 	}
+-	if (!options.x11_forwarding) {
++	if (!options.x11_forwarding || options.disable_forwarding) {
+ 		debug("X11 forwarding disabled in server configuration file.");
+ 		return 0;
+ 	}
+-- 
+2.39.3
+
diff --git a/openssh.spec b/openssh.spec
index 33736003c5b7d2aa1b6fc58f68b2394c7f15717d..c48d2da048959b0dc574cbe07716b64574890498 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -1,4 +1,4 @@
-%define anolis_release 1
+%define anolis_release 2
 
 %global WITH_SELINUX 1
 
@@ -219,7 +219,8 @@ Patch1014: openssh-8.7p1-nohostsha1proof.patch
 Patch1016: openssh-9.3p1-openssl-compat.patch
 # for loongarch
 Patch1017: add-loongarch64-support-for-openssh.patch
-
+#upstream fc86875e6acb36401dfc1dfb6b628a9d1460f367
+Patch1018: 0001-upstream-Fix-logic-error-in-DisableForwarding-option.patch
 License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
 Requires: /sbin/nologin
 
@@ -435,6 +436,8 @@ popd
 
 #patch for loongarch
 %patch -P 1017 -p1
+# patch for CVE-2025-32728
+%patch -P 1018 -p1
 
 autoreconf
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@@ -746,6 +749,9 @@ test -f %{sysconfig_anaconda} && \
 %endif
 
 %changelog
+* Sat Apr 12 2025  yangjinlin01<yangjinlin01@inspur.com> - 9.3p2-2
+- Fix CVE-2025-32728
+
 * Fri Mar 22 2024 mgb01105731 <mgb01105731@alibaba-inc.com> - 9.3p2-1
 - update to 9.3p2