diff --git a/CVE-2026-63076.patch b/CVE-2026-63076.patch
new file mode 100644
index 0000000000000000000000000000000000000000..d385d1a98383d8c78dea52f8544c51b8d33ec100
--- /dev/null
+++ b/CVE-2026-63076.patch
@@ -0,0 +1,31 @@
+Backport of the fix for CVE-2026-63076
+
+Subject: [PATCH] cmp: check the ASN.1 type of the protectionAlg parameter
+
+When calculating/verifying password based MAC protection of a CMP message,
+the algorithm parameter returned by X509_ALGOR_get0() was cast to an
+ASN1_STRING holding the DER encoded PBMParameter after only checking that
+the value pointer is not NULL.  The parameter type was never consulted, so
+a crafted message carrying a protectionAlg parameter of a different ASN.1
+type (e.g. BOOLEAN, where the value is not a pointer at all) led to an
+invalid pointer dereference and thus to a crash.
+
+This is reachable before any MAC is computed, so no knowledge of the PBM
+shared secret is needed: on the server side via OSSL_CMP_SRV_process_request()
+for applications accepting PBM protected messages, and on the client side
+when validating responses of a malicious or on-path CMP server.
+
+Require the parameter to be a SEQUENCE, as mandated for PBMParameter, before
+treating it as such.
+
+--- a/crypto/cmp/cmp_protect.c
++++ b/crypto/cmp/cmp_protect.c
+@@ -63,7 +63,7 @@ ASN1_BIT_STRING *ossl_cmp_calc_protectio
+             ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET);
+             return NULL;
+         }
+-        if (ppval == NULL) {
++        if (ppval == NULL || pptype != V_ASN1_SEQUENCE) {
+             ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
+             return NULL;
+         }
diff --git a/openssl.spec b/openssl.spec
index 2cc0b09926b97cedbdeb0c15212aaf35f9ae5b43..617f5f4a210320829e34869026a0f094c77f5ba8 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -1,4 +1,4 @@
-%define anolis_release 29
+%define anolis_release 30
 
 ExcludeArch: riscv64
 
@@ -180,6 +180,10 @@ Patch00118: 00118-bugfix-for-CVE-2026-45447.patch
 # CVE-2026-54874 https://git.launchpad.net/ubuntu/+source/openssl
 Patch00119: 00119-bugfix-for-CVE-2026-54874.patch
 Patch00120: 00120-bugfix-for-CVE-2026-54874.patch
+# CVE-2026-63076
+# Source: upstream
+# Reference: https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b
+Patch00121: CVE-2026-63076.patch
 
 BuildRequires:  gcc git coreutils perl-interpreter sed zlib-devel /usr/bin/cmp
 BuildRequires:  lksctp-tools-devel
@@ -389,6 +393,11 @@ rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/{openssl.cnf.dist,ct_log_list.cnf.di
 %doc NEWS.md README.md
 
 %changelog
+* Sat Aug 29 2026 PengLAI Code <rel-eng@openanolis.org> - 1:3.0.12-30
+- Fix CVE-2026-63076
+- Upstream patch: https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b
+- Adapted by PengLAI Code
+
 * Wed Aug 26 2026 tomcruiseqi <tomcruiseqi@inspur.com> - 1:3.0.12-29
 - Fix CVE-2026-54874