diff --git a/fix-CVE-2026-66034.patch b/fix-CVE-2026-66034.patch
new file mode 100644
index 0000000000000000000000000000000000000000..c0d06df375727cd1f7d3403515db4f713cc27d8a
--- /dev/null
+++ b/fix-CVE-2026-66034.patch
@@ -0,0 +1,31 @@
+From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Sat, 4 Jul 2026 11:19:49 +0200
+Subject: [PATCH] publickey: fix potential OOB read in
+ `libssh2_publickey_list_fetch()`
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-w6g9-cpfp-22gc
+
+Closes #2202
+Forwarded: not-needed
+---
+ src/publickey.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/src/publickey.c
++++ b/src/publickey.c
+@@ -988,6 +988,13 @@
+                 }
+ 
+                 if(comment_len) {
++                    if(pkey->listFetch_s + comment_len >
++                       pkey->listFetch_data + pkey->listFetch_data_len) {
++                        _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++                                 "ListFetch data too short");
++                        goto err_exit;
++                    }
++
+                     list[keys].num_attrs = 1;
+                     list[keys].attrs =
+                         LIBSSH2_ALLOC(session,
diff --git a/libssh2.spec b/libssh2.spec
index ddb889d5087c6734ff23ba55f96f6c058ecfec60..338608eebba306a13f40362b15e0aaf3f1925b98 100644
--- a/libssh2.spec
+++ b/libssh2.spec
@@ -1,4 +1,4 @@
-%define anolis_release 2
+%define anolis_release 3
 
 Name:		libssh2
 Version:	1.11.1
@@ -31,6 +31,8 @@ Patch0004: libssh2-1.11.1-ssh-rsa-test.patch
 Patch0005: libssh-1.11.1-update-rpath-format.patch
 # https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6
 Patch0006: fix-CVE-2026-66033.patch
+# https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9
+Patch0007: fix-CVE-2026-66034.patch
 
 BuildRequires:	autoconf
 BuildRequires:	automake
@@ -146,6 +148,9 @@ LC_ALL=en_US.UTF-8 make -C tests check
 %{_libdir}/pkgconfig/libssh2.pc
 
 %changelog
+* Wed Aug 05 2026 ali-inspur <shenzhongli@inspur.com> - 1.11.1-3
+- Fix CVE-2026-66034
+
 * Sat Aug 01 2026 ali-inspur <shenzhongli@inspur.com> - 1.11.1-2
 - Fix CVE-2026-66033