diff --git a/backport-Fix-heap-corruption.patch b/backport-Fix-heap-corruption.patch
new file mode 100644
index 0000000000000000000000000000000000000000..a6b27a1bcdf68c74de4d62f21f970758c4028b54
--- /dev/null
+++ b/backport-Fix-heap-corruption.patch
@@ -0,0 +1,33 @@
+From e04a67610adeea29541078cbc9e0cf9dab659e6b Mon Sep 17 00:00:00 2001
+From: Guido Kiener <guido.kiener@rohde-schwarz.com>
+Date: Fri, 1 Dec 2023 16:19:27 +0100
+Subject: [PATCH] Fix heap corruption
+
+Calculation of resultlen is wrong. E.g. if server allows
+only one mechanism SCRAM-SHA-256, the expected string for the
+mechlist_buf is "SCRAM-SHA-256-PLUS SCRAM-SHA-256" with a required
+size of 33 bytes and not 32 bytes.
+Note that (strlen(mysep) * (s_conn->mech_length - 1) * 2) = 0
+when s_conn->mech_length = 1.
+
+Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com>
+---
+ lib/server.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/server.c b/lib/server.c
+index c69e58b8..b44155f4 100644
+--- a/lib/server.c
++++ b/lib/server.c
+@@ -1764,7 +1764,7 @@ int _sasl_server_listmech(sasl_conn_t *conn,
+       INTERROR(conn, SASL_NOMECH);
+ 
+   resultlen = (prefix ? strlen(prefix) : 0)
+-            + (strlen(mysep) * (s_conn->mech_length - 1) * 2)
++            + (strlen(mysep) * (s_conn->mech_length * 2 - 1))
+ 	    + (mech_names_len(s_conn->mech_list) * 2) /* including -PLUS variant */
+ 	    + (s_conn->mech_length * (sizeof("-PLUS") - 1))
+             + (suffix ? strlen(suffix) : 0)
+-- 
+2.33.0
+
diff --git a/cyrus-sasl.spec b/cyrus-sasl.spec
index 5abce2588ffe9fc38a4397ff4de5028729f318db..f3d1eaf3230689592cf8b75cafa9f0e4f5c59527 100644
--- a/cyrus-sasl.spec
+++ b/cyrus-sasl.spec
@@ -6,7 +6,7 @@
 
 Name: cyrus-sasl
 Version: 2.1.27
-Release: 16
+Release: 17
 Summary: The Cyrus SASL API Implementation
 
 License: BSD with advertising
@@ -20,6 +20,7 @@ Patch1: fix-CVE-2019-19906.patch
 Patch2: backport-db_gdbm-fix-gdbm_errno-overlay-from-gdbm_close.patch
 Patch3: backport-CVE-2022-24407-Escape-password-for-SQL-insert-update.patch
 Patch4: backport-Use-int-instead-of-char-for-variable-c.patch
+Patch5: backport-Fix-heap-corruption.patch
 
 BuildRequires: autoconf, automake, libtool, gdbm-devel, groff
 BuildRequires: krb5-devel >= 1.2.2, openssl-devel, pam-devel, pkgconfig
@@ -327,6 +328,9 @@ getent passwd %{username} >/dev/null || useradd -r -g %{username} -d %{homedir}
 
 
 %changelog
+* Thu Dec 19 2024 yixiangzhike <yixiangzhike007@163.com> - 2.1.27-17
+- backport upstream patch to fix heap corruption
+
 * Fri Oct 11 2024 yixiangzhike <yixiangzhike007@163.com> - 2.1.27-16
 - backport upstream patch to fix char overflow