diff --git a/backport-Fix-for-CVE-2017-16516.patch b/backport-Fix-for-CVE-2017-16516.patch
new file mode 100644
index 0000000000000000000000000000000000000000..7d4881634144527cabea02c9b9b437ac8e95b328
--- /dev/null
+++ b/backport-Fix-for-CVE-2017-16516.patch
@@ -0,0 +1,43 @@
+From 0b5e73c4321de0ba1d495fdc0967054b2a77931c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Mon, 10 Jul 2023 13:36:10 +0100
+Subject: [PATCH 5/8] Fix for CVE-2017-16516
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Description: Fix for CVE-2017-16516
+ Potential buffer overread: A JSON file can cause denial of service.
+Origin: https://github.com/brianmario/yajl-ruby/commit/a8ca8f476655adaa187eedc60bdc770fff3c51ce
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040036
+Bug: https://github.com/lloyd/yajl/issues/248
+
+Patch taken from Debian package source
+
+NB, Fedora code can't trigger the reported aborts since it passes the
+-DNDEBUG flag, but pulling the fix for robustness in case a future
+change enables the assert()s.
+
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+---
+ src/yajl_encode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/yajl_encode.c b/src/yajl_encode.c
+index fd08258..0d97cc5 100644
+--- a/src/yajl_encode.c
++++ b/src/yajl_encode.c
+@@ -139,8 +139,8 @@ void yajl_string_decode(yajl_buf buf, const unsigned char * str,
+                     end+=3;
+                     /* check if this is a surrogate */
+                     if ((codepoint & 0xFC00) == 0xD800) {
+-                        end++;
+-                        if (str[end] == '\\' && str[end + 1] == 'u') {
++                        if (end + 2 < len && str[end + 1] == '\\' && str[end + 2] == 'u') {
++                            end++;
+                             unsigned int surrogate = 0;
+                             hexToDigit(&surrogate, str + end + 2);
+                             codepoint =
+-- 
+2.41.0
+
diff --git a/yajl.spec b/yajl.spec
index 6f122321df80057c320fc2592a4b85dd9762f3a0..9350d9e5e1ceb29305de6b4b151b20508650ea27 100644
--- a/yajl.spec
+++ b/yajl.spec
@@ -1,6 +1,9 @@
+%undefine __cmake_in_source_build
+%global _vpath_builddir build
+
 Name:           yajl
 Version:        2.1.0
-Release:        20
+Release:        23
 Summary:        Yet Another JSON Library
 License:        ISC
 URL:            https://github.com/lloyd/yajl
@@ -15,8 +18,10 @@ Patch6:         0006-fix-memory-leak-of-ctx-root.patch
 Patch7:         0007-add-cmake-option-for-test-and-binary.patch
 Patch8:         backport-CVE-2022-24795.patch
 Patch9:         yajl-assert-error-when-memory-allocation-failed.patch
+Patch10:         backport-Fix-for-CVE-2017-16516.patch
 
-BuildRequires:  cmake gcc
+BuildRequires:  gcc
+BuildRequires:  cmake >= 3.4
 
 %description
 yajl is a small event-driven JSON parser written in ANSI C, and a small
@@ -25,6 +30,7 @@ validating JSON generator.
 %package        devel
 Summary:        Development files for %{name}
 Requires:       %{name} = %{version}-%{release}
+Conflicts:      yajl < 2.1.0-21
 
 %description    devel
 This package provides the libraries and includes
@@ -34,43 +40,42 @@ necessary for developing against the yajl library.
 %autosetup -n %{name}-%{version} -p1
 
 %build
-mkdir build
-cd build
-%cmake ..
-%make_build VERBOSE=1
+%cmake
+%cmake_build
 
 %install
-rm -rf $RPM_BUILD_ROOT
-cd build
-%make_install
+%cmake_install
 
 %check
-cd test/parsing
-./run_tests.sh
-cd ../api
-./run_tests.sh
+#cd test
+#(cd parsing && ./run_tests.sh)
+#(cd api && ./run_tests.sh)
+#Run the 'make test' command to execute the test case temporarily
+%make_build test
 
 %files
-%defattr(-,root,root)
-%doc COPYING README ChangeLog TODO
+%license COPYING
+%doc README ChangeLog TODO
 %{_bindir}/json_reformat
 %{_bindir}/json_verify
-
 %{_libdir}/libyajl.so.*
-%{_libdir}/libyajl.so
 
 %files devel
-%dir %{_includedir}/yajl
-%{_includedir}/yajl/yajl_common.h
-%{_includedir}/yajl/yajl_gen.h
-%{_includedir}/yajl/yajl_parse.h
-%{_includedir}/yajl/yajl_tree.h
-%{_includedir}/yajl/yajl_version.h
-
-%{_libdir}/pkgconfig/yajl.pc
+%{_includedir}/yajl
+%{_libdir}/libyajl.so
 %{_libdir}/libyajl_s.a
+%{_libdir}/pkgconfig/yajl.pc
 
 %changelog
+* Tue Jan 14 2025 pengjian <pengjian23@mails.ucas.ac.cn> - 2.1.0-23
+- fix CVE-2017-16516
+
+* Fri Dec 13 2024 fuanan <fuanan3@h-partners.com> - 2.1.0-22
+- fix test failure
+
+* Mon Nov 04 2024 Funda Wang <fundawang@yeah.net> - 2.1.0-21
+- adopt to new cmake macro
+
 * Wed Nov 16 2022 fuanan <fuanan3@h-partners.com> - 2.1.0-20
 - Modify Source0
 
diff --git a/yajl.yaml b/yajl.yaml
index ec970a37b6a7dfe4601863325503d221524da1e1..0d9180b0c3247a096f397383ec67be3f92a7f51c 100644
--- a/yajl.yaml
+++ b/yajl.yaml
@@ -1,4 +1,4 @@
 version_control: github
 src_repo: "lloyd/yajl"
 tag_prefix:
-seperator:
+sparator: