diff --git a/puma-3.12.4.gem b/puma-3.12.4.gem
deleted file mode 100644
index 41b5e59ad201be60ba6fc485454551cb107eae5d..0000000000000000000000000000000000000000
Binary files a/puma-3.12.4.gem and /dev/null differ
diff --git a/puma-3.12.6.gem b/puma-3.12.6.gem
new file mode 100644
index 0000000000000000000000000000000000000000..64d2a5b236a1e589e4e31770a6f5aeb20e233c70
Binary files /dev/null and b/puma-3.12.6.gem differ
diff --git a/rubygem-puma.spec b/rubygem-puma.spec
index 00175eaebf390fdf83bf9bd621f4b8f082754a5e..d32d02ce6030f85ecb9e6563b097ebc96aced1bd 100644
--- a/rubygem-puma.spec
+++ b/rubygem-puma.spec
@@ -1,7 +1,7 @@
 %global gem_name puma
 %bcond_with ragel
 Name:                rubygem-%{gem_name}
-Version:             3.12.4
+Version:             3.12.6
 Release:             1
 Summary:             A simple, fast, threaded, and highly concurrent HTTP 1.1 server
 License:             BSD
@@ -64,6 +64,7 @@ sed -i "/require 'minitest\/retry'/ s/^/#/" test/helper.rb
 sed -i "/Minitest::Retry/ s/^/#/" test/helper.rb
 sed -i '/^  def test_timeout_in_data_phase$/a\
     skip "Unstable test"' test/test_puma_server.rb
+sed -i "s/X_FORWARDED_PROTO/X-FORWARDED-PROTO/g" test/test_puma_server.rb
 sed -i '/^  def test_control_url$/a\
     skip "Unstable test"' test/test_pumactl.rb
 sed -i '/^  def test_ssl_v3_rejection$/a\
@@ -95,5 +96,11 @@ popd
 %{gem_instdir}/tools
 
 %changelog
+* Wed Feb 03 2021 shinwell_hu <micromotive@qq.com> - 3.12.6-1
+- Upgrade to 3.12.6 to fix following known CVEs
+  CVE-2020-11077
+  CVE-2020-11076
+- Workaround test failure on x forwarded protol
+
 * Thu Aug 20 2020 luoshengwei <luoshengwei@huawei.com> - 3.12.4-1
 - package init
diff --git a/v3.12.4.tar.gz b/v3.12.4.tar.gz
deleted file mode 100644
index d263a56eb1f3630c88c15ddf89b2e3ce4fd93224..0000000000000000000000000000000000000000
Binary files a/v3.12.4.tar.gz and /dev/null differ
diff --git a/v3.12.6.tar.gz b/v3.12.6.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..9e3356df14e27dbc7146c37911f996ff5cba04c3
Binary files /dev/null and b/v3.12.6.tar.gz differ