diff --git a/python-urllib3.spec b/python-urllib3.spec
index 076b4dc68d843147523c600a380ffab55af20e13..13c325cfeeec984188278ebfb70340562a5be6c3 100644
--- a/python-urllib3.spec
+++ b/python-urllib3.spec
@@ -1,9 +1,9 @@
-%define anolis_release 2
+%define anolis_release 1
 %bcond_with tests
 %global pypi_name urllib3
 
 Name:           python-%{pypi_name}
-Version:        1.26.18
+Version:        1.26.19
 Release:        %{anolis_release}%{dist}
 Summary:        Python HTTP library with thread-safe connection pooling and file post
 License:        MIT
@@ -73,6 +73,10 @@ sed -i -e 's/^import mock/from unittest import mock/' \
 %doc CHANGES.rst README.rst
 
 %changelog
+* Fri Nov 01 2024 mgb01105731 <mgb01105731@alibaba-inc.com> - 1.26.19-1
+- update to 1.26.19
+- fix CVE-2024-37891
+
 * Mon Mar 11 2024 Zhao Hang <wb-zh951434@alibaba-inc.com> - 1.26.18-2
 - Rebuild with python3.11
 
diff --git a/urllib3-1.26.18.tar.gz b/urllib3-1.26.18.tar.gz
deleted file mode 100644
index 9c93a68b7171cae312e0afd6c7922c584e7cb5e3..0000000000000000000000000000000000000000
Binary files a/urllib3-1.26.18.tar.gz and /dev/null differ
diff --git a/urllib3-1.26.19.tar.gz b/urllib3-1.26.19.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..265fcd71cb8d5b2ae7fe90d19714dc71fb4bd950
Binary files /dev/null and b/urllib3-1.26.19.tar.gz differ