diff --git a/backport-CVE-2024-47081.patch b/backport-CVE-2024-47081.patch
new file mode 100644
index 0000000000000000000000000000000000000000..dc3b2de1a6551bdd99e04bc1bd705cc4ed93d500
--- /dev/null
+++ b/backport-CVE-2024-47081.patch
@@ -0,0 +1,31 @@
+From 96ba401c1296ab1dda74a2365ef36d88f7d144ef Mon Sep 17 00:00:00 2001
+From: Nate Prewitt <nate.prewitt@gmail.com>
+Date: Wed, 25 Sep 2024 08:03:20 -0700
+Subject: [PATCH] Only use hostname to do netrc lookup instead of netloc
+
+Reference:https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef
+Conflict:Modify file path adaptation:src/requests/utils.py->requests/utils.py and Delete Code Adaptation
+
+---
+ requests/utils.py | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/requests/utils.py b/requests/utils.py
+index 699683e5d9..8a307ca8a0 100644
+--- a/requests/utils.py
++++ b/requests/utils.py
+@@ -236,13 +236,7 @@ def get_netrc_auth(url, raise_errors=False):
+             return
+ 
+         ri = urlparse(url)
+-
+-        # Strip port numbers from netloc. This weird `if...encode`` dance is
+-        # used for Python 3.2, which doesn't support unicode literals.
+-        splitstr = b':'
+-        if isinstance(url, str):
+-            splitstr = splitstr.decode('ascii')
+-        host = ri.netloc.split(splitstr)[0]
++        host = ri.hostname
+ 
+         try:
+             _netrc = netrc(netrc_path).authenticators(host)
diff --git a/python-requests.spec b/python-requests.spec
index 8760a8fb709a9568f22a68114b0d51e9f83f7c1b..972dfcf935ef5e050a6f59352102dc75c28c29a9 100644
--- a/python-requests.spec
+++ b/python-requests.spec
@@ -2,7 +2,7 @@
 
 Name:           python-requests
 Version:        2.24.0
-Release:        3
+Release:        4
 Summary:        Python HTTP Library
 License:        ASL 2.0
 URL:            http://python-requests.org/
@@ -14,6 +14,7 @@ Patch3:         patch-requests-certs.py-to-use-the-system-CA-bundle.patch
 Patch4:         Remove-tests-that-use-the-tarpit.patch 
 Patch6000:      backport-CVE-2023-32681.patch
 Patch6001:      backport-CVE-2024-1682.patch
+Patch6002:      backport-CVE-2024-47081.patch
 
 BuildArch:      noarch
 
@@ -114,6 +115,9 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v
 %doc HISTORY.md README.md
 
 %changelog
+* Mon Jun 23 2025 zhangpan <zhangpan103@h-partners.com> - 2.24.0-4
+- fix CVE-2024-47081
+
 * Mon Nov 18 2024 zhangpan <zhangpan103@h-partners.com> - 2.24.0-3
 - fix CVE-2024-1682