diff --git a/1000-add-patch-to-fix-CVE-2025-57833.patch b/1000-add-patch-to-fix-CVE-2025-57833.patch
new file mode 100644
index 0000000000000000000000000000000000000000..bc03fee280064ae39538e6a1cd6b32866b29fb39
--- /dev/null
+++ b/1000-add-patch-to-fix-CVE-2025-57833.patch
@@ -0,0 +1,95 @@
+From 4bfd4f6fc10024cf0ef9715cd1135bbf091e5292 Mon Sep 17 00:00:00 2001
+From: lzq11122 <lzq02303433@alibaba-inc.com>
+Date: Wed, 12 Nov 2025 15:15:19 +0800
+Subject: [PATCH 1/1] add patch to fix CVE-2025-57833
+
+---
+ django/db/models/sql/query.py |  1 +
+ docs/releases/4.2.24.txt      | 14 ++++++++++++++
+ tests/annotations/tests.py    | 23 +++++++++++++++++++++++
+ 3 files changed, 38 insertions(+)
+ create mode 100644 docs/releases/4.2.24.txt
+
+diff --git a/django/db/models/sql/query.py b/django/db/models/sql/query.py
+index e68fd9e..5a1b685 100644
+--- a/django/db/models/sql/query.py
++++ b/django/db/models/sql/query.py
+@@ -1620,6 +1620,7 @@ class Query(BaseExpression):
+         return target_clause
+ 
+     def add_filtered_relation(self, filtered_relation, alias):
++        self.check_alias(alias)
+         filtered_relation.alias = alias
+         lookups = dict(get_children_from_q(filtered_relation.condition))
+         relation_lookup_parts, relation_field_parts, _ = self.solve_lookup_type(
+diff --git a/docs/releases/4.2.24.txt b/docs/releases/4.2.24.txt
+new file mode 100644
+index 0000000..e501483
+--- /dev/null
++++ b/docs/releases/4.2.24.txt
+@@ -0,0 +1,14 @@
++===========================
++Django 4.2.24 release notes
++===========================
++
++*September 3, 2025*
++
++Django 4.2.24 fixes a security issue with severity "high" in 4.2.23.
++
++CVE-2025-57833: Potential SQL injection in ``FilteredRelation`` column aliases
++==============================================================================
++
++:class:`.FilteredRelation` was subject to SQL injection in column aliases,
++using a suitably crafted dictionary, with dictionary expansion, as the
++``**kwargs`` passed to :meth:`.QuerySet.annotate` or :meth:`.QuerySet.alias`.
+diff --git a/tests/annotations/tests.py b/tests/annotations/tests.py
+index e0cdbf1..1a07cd5 100644
+--- a/tests/annotations/tests.py
++++ b/tests/annotations/tests.py
+@@ -12,6 +12,7 @@ from django.db.models import (
+     Exists,
+     ExpressionWrapper,
+     F,
++    FilteredRelation,
+     FloatField,
+     Func,
+     IntegerField,
+@@ -1120,6 +1121,23 @@ class NonAggregateAnnotationTestCase(TestCase):
+         )
+         with self.assertRaisesMessage(ValueError, msg):
+             Book.objects.annotate(**{crafted_alias: Value(1)})
++    def test_alias_filtered_relation_sql_injection(self):
++        crafted_alias = """injected_name" from "annotations_book"; --"""
++        msg = (
++            "Column aliases cannot contain whitespace characters, quotation marks, "
++            "semicolons, or SQL comments."
++        )
++        with self.assertRaisesMessage(ValueError, msg):
++            Book.objects.alias(**{crafted_alias: FilteredRelation("authors")})
++
++    def test_alias_filtered_relation_sql_injection(self):
++        crafted_alias = """injected_name" from "annotations_book"; --"""
++        msg = (
++            "Column aliases cannot contain whitespace characters, quotation marks, "
++            "semicolons, or SQL comments."
++        )
++        with self.assertRaisesMessage(ValueError, msg):
++            Book.objects.annotate(**{crafted_alias: FilteredRelation("author")})
+ 
+     def test_alias_forbidden_chars(self):
+         tests = [
+@@ -1146,6 +1164,11 @@ class NonAggregateAnnotationTestCase(TestCase):
+                 with self.assertRaisesMessage(ValueError, msg):
+                     Book.objects.annotate(**{crafted_alias: Value(1)})
+ 
++                with self.assertRaisesMessage(ValueError, msg):
++                    Book.objects.annotate(
++                        **{crafted_alias: FilteredRelation("authors")}
++                    )
++
+ 
+ class AliasTests(TestCase):
+     @classmethod
+-- 
+2.43.5
+
diff --git a/python-django.spec b/python-django.spec
index 875f163ca7b0602e82511041dfc0da6ac1d20e5e..999e532b05a8b7bb8ea645db1368820e63491e21 100644
--- a/python-django.spec
+++ b/python-django.spec
@@ -1,4 +1,4 @@
-%define anolis_release 2
+%define anolis_release 3
 %global pkgname Django
 
 Name:           python-django
@@ -15,6 +15,8 @@ BuildArch:      noarch
 
 # https://github.com/django/django/commit/790eb058b0716c536a2f2e8d1c6d5079d776c22b
 Patch0001:    0001-fix-CVE-2024-53907.patch
+# https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92
+Patch0002:    1000-add-patch-to-fix-CVE-2025-57833.patch
 
 %global _description %{expand:
 Django is a high-level Python Web framework that encourages rapid
@@ -152,9 +154,13 @@ cd tests
 
 # disable two tests due to regression in 3.12b4:
 # https://github.com/python/cpython/issues/106669
+%global python3_version_num %(echo %{python3_version} | awk -F. '{ printf "%d%02d%02d", $$1,$$2,$$3 }')
+%if %{python3_version_num} >= 31200
 %{python3} runtests.py --settings=test_sqlite --verbosity=2 --parallel 1 \
-%if v"%{python3_version}" >= v"3.12"
   -k "not test_safe_mime_multipart and not test_unicode_address_header"
+%else
+%{python3} runtests.py --settings=test_sqlite --verbosity=2 --parallel 1 \
+  -k "not test_strip_tags and not test_safe_mime_multipart and not test_unicode_address_header"
 %endif
 #%%{python3} runtests.py --settings=test_sqlite --verbosity=2 --parallel 1
 
@@ -175,6 +181,9 @@ cd tests
 
 
 %changelog
+* Wed Nov 12 2025 lzq11122 <lzq02303433@alibaba-inc.com> - 4.2.16-3
+- Add patch to fix CVE-2025-57833
+
 * Tue Jun 10 2025 wenxin <wx02272781@alibaba-inc.com> - 4.2.16-2
 - Fix CVE-2024-53907