diff --git a/openjdk-latest.spec b/openjdk-latest.spec
index 9c109e09e14f6672d8d65b4abb471ebd1bccda0f..d35a6506d0ea91e7f69aaf4746f42a447ee8389b 100644
--- a/openjdk-latest.spec
+++ b/openjdk-latest.spec
@@ -171,7 +171,7 @@
 %global top_level_dir_name   %{origin}
 %global minorver        0
 %global buildver        12
-%global rpmrelease      0
+%global rpmrelease      1
 # priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
 %global priority %( printf '%02d%02d%02d%02d' %{majorver} %{minorver} %{securityver} %{buildver} )
@@ -1256,8 +1256,8 @@ export CFLAGS="$CFLAGS -mieee"
 # We use ourcppflags because the OpenJDK build seems to
 # pass EXTRA_CFLAGS to the HotSpot C++ compiler...
 # Explicitly set the C++ standard as the default has changed on GCC >= 6
-EXTRA_CFLAGS="%ourcppflags"
-EXTRA_CPP_FLAGS="%ourcppflags"
+EXTRA_CFLAGS="%ourcppflags -fstack-protector-all"
+EXTRA_CPP_FLAGS="%ourcppflags -fstack-protector-all"
 
 %ifarch %{power64} ppc
 # fix rpmlint warnings
@@ -1732,6 +1732,9 @@ require "copy_jdk_configs.lua"
 
 
 %changelog
+* Mon Dec 6 2021 noah <hedongbo@huawei.com> - 1:17.0.1.12-1-rolling
+- add Stack protection
+
 * Fri Nov 12 2021 noah <hedongbo@huawei.com> - 1:17.0.1.12-0-rolling
 - Update to jdk-17.0.1+12