diff --git a/Gemfile.lock b/Gemfile.lock
index 427b747bd2aa7c639f507a162042204a70778978..a14e5a926d005cb603371cb0eb5f6bc0d4e9b143 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -468,7 +468,7 @@ GEM
     websocket-driver (0.7.1)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.4)
-    xmlhash (1.3.7)
+    xmlhash (1.3.8)
       pkg-config
     xmlrpc (0.3.0)
     xpath (3.2.0)
diff --git a/obs-server.spec b/obs-server.spec
index 3774ac800fb8333bc0512dedd52d01d616bd1c4d..6302c8e735d56b9777decea91c22c74094594c60 100644
--- a/obs-server.spec
+++ b/obs-server.spec
@@ -5,7 +5,7 @@
 
 Name:           obs-server
 Version:        2.10.11
-Release:        2
+Release:        3
 Summary:        The Open Build Service -- Server Component
 License:        GPL-2.0-only or GPL-3.0-only
 URL:            http://www.openbuildservice.org
@@ -494,6 +494,9 @@ usermod -a -G docker obsservicerun
 %{_sbindir}/rcobsstoragesetup
 
 %changelog
+* Mon May 16 2022 wangkai <wangkai385@h-partners.com> - 2.10.11-3
+- Update xmlhash to 1.3.8 for fix CVE-2022-21949
+
 * Thu Mar 17 2022 houyingchao <houyingchao@huawei.com> - 2.10.11-2
 - Fix install failed