diff --git a/cups.spec b/cups.spec
index 43fa44ddb1c1a5072fa17c37acddba545da9e59b..2ba06393977161eece00634aed2f2c8039420de0 100644
--- a/cups.spec
+++ b/cups.spec
@@ -3,7 +3,7 @@
 Name:    cups
 Epoch:   1
 Version: 2.4.11
-Release: 1
+Release: 2
 Summary: CUPS is the standards-based, open source printing system for linux operating systems.
 License: Apache-2.0
 Url:     https://openprinting.github.io/cups/
@@ -24,6 +24,7 @@ Patch9:  cups-ipp-multifile.patch
 Patch10: cups-web-devices-timeout.patch
 Patch100: cups-lspp.patch
 Patch101: fix-httpAddrGetList-test-case-fail.patch
+Patch102: fix-CVE-2025-58060.patch
 
 BuildRequires: pam-devel pkgconfig(gnutls) libacl-devel openldap-devel pkgconfig(libusb-1.0)
 BuildRequires: krb5-devel pkgconfig(avahi-client) systemd pkgconfig(libsystemd) pkgconfig(dbus-1) python3-cups
@@ -415,6 +416,9 @@ rm -f %{_exec_prefix}/lib/cups/backend/smb
 %doc %{_datadir}/%{name}/www/apple-touch-icon.png
 
 %changelog
+* Fri Sep 12 2025 cenhuilin <cenhuilin@kylinos.cn> - 1:2.4.11-2
+- fix CVE-2025-58060
+
 * Wed Oct 09 2024 Funda Wang <fundawang@yeah.net> - 1:2.4.11-1
 - update to version 2.4.11
 
diff --git a/fix-CVE-2025-58060.patch b/fix-CVE-2025-58060.patch
new file mode 100644
index 0000000000000000000000000000000000000000..b572efcc6ca69f7fef0b8d1b266f26e05194baf6
--- /dev/null
+++ b/fix-CVE-2025-58060.patch
@@ -0,0 +1,59 @@
+From 595d691075b1d396d2edfaa0a8fd0873a0a1f221 Mon Sep 17 00:00:00 2001
+From: Zdenek Dohnal <zdohnal@redhat.com>
+Date: Fri, 12 Sep 2025 09:16:56 +0800
+Subject: [PATCH] cupsd: Block authentication using alternate method
+
+Fixes: CVE-2025-58060
+---
+ scheduler/auth.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/scheduler/auth.c b/scheduler/auth.c
+index 5fa5364..3c9aa72 100644
+--- a/scheduler/auth.c
++++ b/scheduler/auth.c
+@@ -513,6 +513,16 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
+     int	userlen;			/* Username:password length */
+ 
+ 
++   /*
++    * Only allow Basic if enabled...
++    */
++
++    if (type != CUPSD_AUTH_BASIC)
++    {
++      cupsdLogClient(con, CUPSD_LOG_ERROR, "Basic authentication is not enabled.");
++      return;
++    }
++
+     authorization += 5;
+     while (isspace(*authorization & 255))
+       authorization ++;
+@@ -558,7 +568,6 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
+     * Validate the username and password...
+     */
+ 
+-    if (type == CUPSD_AUTH_BASIC)
+     {
+ #if HAVE_LIBPAM
+      /*
+@@ -727,6 +736,16 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
+ 					/* Output token for username */
+     gss_name_t		client_name;	/* Client name */
+ 
++   /*
++    * Only allow Kerberos if enabled...
++    */
++
++    if (type != CUPSD_AUTH_NEGOTIATE)
++    {
++      cupsdLogClient(con, CUPSD_LOG_ERROR, "Kerberos authentication is not enabled.");
++      return;
++    }
++
+ #  ifdef __APPLE__
+    /*
+     * If the weak-linked GSSAPI/Kerberos library is not present, don't try
+-- 
+2.43.0
+