diff --git a/xstream-distribution-1.4.16-src.zip b/xstream-distribution-1.4.17-src.zip
similarity index 83%
rename from xstream-distribution-1.4.16-src.zip
rename to xstream-distribution-1.4.17-src.zip
index fbcb98a51a52385bd913cf644a17b96bd87aee70..67af93cbf9d5185989282bf77a16ffd3b7af1665 100644
Binary files a/xstream-distribution-1.4.16-src.zip and b/xstream-distribution-1.4.17-src.zip differ
diff --git a/xstream.spec b/xstream.spec
index bdd2c9bbe594121d1c4912bff143e413c497d29d..a57f9524d9051ca393f43eed89bac1dcde1d4fd0 100644
--- a/xstream.spec
+++ b/xstream.spec
@@ -1,6 +1,6 @@
 %bcond_with jp_minimal
 Name:                xstream
-Version:             1.4.16
+Version:             1.4.17
 Release:             1
 Summary:             Java XML serialization library
 License:             BSD
@@ -132,6 +132,9 @@ mvn install --settings ./settings.xml -Dmaven.test.skip=true
 %license LICENSE.txt
 
 %changelog
+* Thu May 27 2021 wutao <wutao61@huawei.com> - 1.4.17-1
+- upgrade to 1.4.17 to fix CVE-2021-29505
+
 * Tue Mar 30 2021 wutao <wutao61@huawei.com> - 1.4.16-1
 - update to 1.4.16