diff --git a/Gemfile.lock.aarch64 b/Gemfile.lock.aarch64
index 2ae0a67beb41954699a91de7646143bebed7eaae..3853f6048bc4f21f63bc37672c5c53becc96b59c 100644
--- a/Gemfile.lock.aarch64
+++ b/Gemfile.lock.aarch64
@@ -1,5 +1,5 @@
 GEM
-  remote: https://rubygems.org/
+  remote: https://anonymous:devcloud@mirrors.huaweicloud.com/repository/rubygems/
   specs:
     actioncable (5.2.7)
       actionpack (= 5.2.7)
@@ -476,7 +476,7 @@ GEM
     websocket-driver (0.7.5)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
-    xmlhash (1.3.7)
+    xmlhash (1.3.8)
       pkg-config
     xmlrpc (0.3.2)
       webrick
diff --git a/Gemfile.lock.x86 b/Gemfile.lock.x86
index 4357e5a4cbc2c2fc66bfab6d94a1193f0659ce97..2903b9b59b4ee2223cf71c0c14ae76ea9551533b 100644
--- a/Gemfile.lock.x86
+++ b/Gemfile.lock.x86
@@ -1,5 +1,5 @@
 GEM
-  remote: https://rubygems.org/
+  remote: https://anonymous:devcloud@mirrors.huaweicloud.com/repository/rubygems/
   specs:
     actioncable (5.2.7)
       actionpack (= 5.2.7)
@@ -476,7 +476,7 @@ GEM
     websocket-driver (0.7.5)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
-    xmlhash (1.3.7)
+    xmlhash (1.3.8)
       pkg-config
     xmlrpc (0.3.2)
       webrick
diff --git a/obs-server.spec b/obs-server.spec
index cccc5a57158e5445dcf8a37a7281e8dae3236721..abdf3bcf5e13a29dca52a6101988f071373cda64 100644
--- a/obs-server.spec
+++ b/obs-server.spec
@@ -6,7 +6,7 @@
 
 Name:           obs-server
 Version:        2.10.11
-Release:        3
+Release:        4
 Summary:        The Open Build Service -- Server Component
 License:        GPL-2.0-only OR GPL-3.0-only
 URL:            http://www.openbuildservice.org
@@ -516,6 +516,9 @@ usermod -a -G docker obsservicerun
 %{_sbindir}/rcobsstoragesetup
 
 %changelog
+* Mon May 16 2022 wangkai <wangkai385@h-partners.com> - 2.10.11-4
+- Update xmlhash to 1.3.8 for fix CVE-2022-21949
+
 * Mon Mar 28 2022 wulei <wulei80@huawei.com> - 2.10.11-3
 - Fix installation failed