diff --git a/backport-CVE-2024-56406.patch b/backport-CVE-2024-56406.patch
new file mode 100644
index 0000000000000000000000000000000000000000..42f3d6bcdc84486fafdd665876fc738bdbedf425
--- /dev/null
+++ b/backport-CVE-2024-56406.patch
@@ -0,0 +1,26 @@
+From 87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd Mon Sep 17 00:00:00 2001
+From: Karl Williamson <khw@cpan.org>
+Date: Wed, 18 Dec 2024 18:25:29 -0700
+Subject: [PATCH] CVE-2024-56406: Heap-buffer-overflow with tr//
+
+This was due to underallocating needed space.  If the translation forces
+something to become UTF-8 that is initially bytes, that UTF-8 could
+now require two bytes where previously a single one would do.
+
+(cherry picked from commit f93109c8a6950aafbd7488d98e112552033a3686)
+---
+ op.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/op.c b/op.c
+index 69ff030e88eb..298b2926338a 100644
+--- a/op.c
++++ b/op.c
+@@ -6520,6 +6520,7 @@
+                  * same time.  But otherwise one crosses before the other */
+                 if (t_cp < 256 && r_cp_end > 255 && r_cp != t_cp) {
+                     can_force_utf8 = TRUE;
++                    max_expansion = MAX(2, max_expansion);
+                 }
+             }
+ 
diff --git a/perl.spec b/perl.spec
index f1ff66d26a6ccc4a7d073801fa7962ef16ff306f..40aa01660e8fa0d6284af2b4fb379b3b8070e8d0 100644
--- a/perl.spec
+++ b/perl.spec
@@ -26,7 +26,7 @@ Name:           perl
 License:        (GPL-1.0-or-later or Artistic-1.0-perl) and (GPL-2.0-or-later or Artistic-1.0-perl) and MIT and UCD and Public Domain and BSD
 Epoch:          4
 Version:        %{perl_version}
-Release:        10
+Release:        11
 Summary:        A highly capable, feature-rich programming language
 Url:            https://www.perl.org/
 Source0:        https://www.cpan.org/src/5.0/%{name}-%{version}.tar.xz
@@ -45,6 +45,7 @@ Patch9: perl-5.38.0-Link-XS-modules-to-libperl.so-with-EU-MM.patch
 Patch10: perl-5.38.0-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
 
 Patch6000: backport-aarch64-ilp32-support.patch
+Patch6001: backport-CVE-2024-56406.patch
 
 BuildRequires:  gcc bash findutils coreutils make tar procps bzip2-devel gdbm-devel perl-File-Compare perl-File-Find 
 BuildRequires:  zlib-devel perl-interpreter perl-generators
@@ -504,6 +505,9 @@ make test_harness
 %{_mandir}/man3/*
 
 %changelog
+* Mon Apr 14 2025 Funda Wang <fundawang@yeah.net> - 4:5.38.0-11
+- fix CVE-2024-56406
+
 * Fri Jan 03 2025 Funda Wang <fundawang@yeah.net> - 4:5.38.0-10
 - split out patch adding link to libperl.so into two separated patches,
   and sync it with mageia, which is a better version than fedora