diff --git a/openldap-2.6.5-its-10530-syncrepl-detect-malformed-sync-ae04732.patch b/openldap-2.6.5-its-10530-syncrepl-detect-malformed-sync-ae04732.patch
new file mode 100644
index 0000000000000000000000000000000000000000..8960d764684a01a0103f3ceeeab3f9a5c61b8639
--- /dev/null
+++ b/openldap-2.6.5-its-10530-syncrepl-detect-malformed-sync-ae04732.patch
@@ -0,0 +1,32 @@
+From ae0473221bb230f2ab95d9d76ed5334bb4d97e6e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
+Date: Tue, 14 Jul 2026 12:21:04 +0100
+Subject: [PATCH] ITS#10530 syncrepl: detect malformed SYNC_ID_SET messages
+
+---
+ servers/slapd/syncrepl.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+diff --git a/servers/slapd/syncrepl.c b/servers/slapd/syncrepl.c
+index 80f73a2..ae6ff1c 100644
+--- a/servers/slapd/syncrepl.c
++++ b/servers/slapd/syncrepl.c
+@@ -1897,7 +1897,7 @@ logerr:
+ 					syncUUIDs = NULL;
+ 					rc = ber_scanf( ber, "[W]", &syncUUIDs );
+ 					ber_scanf( ber, /*"{"*/ "}" );
+-					if ( rc != LBER_ERROR ) {
++					if ( rc != LBER_ERROR && syncUUIDs ) {
+ 						if ( refreshDeletes ) {
+ 							syncrepl_del_nonpresent( op, si, syncUUIDs,
+ 								&syncCookie, m );
+@@ -4002,6 +4002,10 @@ presentlist_insert(
+ {
+ 	char *val;
+ 
++	if ( syncUUID->bv_len != UUIDLEN ) {
++		return 1;
++	}
++
+ #ifdef HASHUUID
+ 	Avlnode **av;
+ 	unsigned short s;
diff --git a/openldap.spec b/openldap.spec
index 8fa9c93fa132b682dd1982e87662c6095e39465f..fea134e278a04e279fae56e51f0449af0bc0bb3b 100644
--- a/openldap.spec
+++ b/openldap.spec
@@ -7,7 +7,7 @@
 Summary: An open source implementation of the LDAP
 Name:    openldap
 Version: 2.6.5
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: OpenLDAP Public License
 URL:     https://www.openldap.org/
 Source0: https://openldap.org/software/download/OpenLDAP/openldap-release/%{name}-%{version}.tgz
@@ -21,6 +21,7 @@ Source7: check_password.conf
 
 
 Patch0001: ITS-10421-mdb_load-check-for-malicious-input.patch
+Patch0002: openldap-2.6.5-its-10530-syncrepl-detect-malformed-sync-ae04732.patch
 
 Patch3000: openldap-manpages.patch
 Patch3001: openldap-reentrant-gethostby.patch
@@ -363,6 +364,10 @@ exit 0
 %{_libdir}/libslapi-2.4*.so.*
 
 %changelog
+* Wed Jul 22 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 2.6.5-7
+- [Type] security
+- [DESC] Fix ITS#10530: syncrepl - detect malformed SYNC_ID_SET messages to prevent null pointer dereference and missing UUID length check
+
 * Mon Jan 12 2026 wynnfeng <wynnfeng@tencent.com> - 2.6.5-6
 - [type] security
 - [desc] Fix CVE-2026-22185: mdb_load: check for malicious input