diff --git a/download b/download
new file mode 100644
index 0000000000000000000000000000000000000000..91e259f71fe28321e94348d07e4b2b72ed89d5b7
--- /dev/null
+++ b/download
@@ -0,0 +1 @@
+4f65e08148d1eaac6b1a1482e7185e1d nmap-7.94.tar.bz2
diff --git a/fix-CVE-2026-58058.patch b/fix-CVE-2026-58058.patch
new file mode 100644
index 0000000000000000000000000000000000000000..406459ccac388c4cb41b84cfdaaa7d5f24a5b4b3
--- /dev/null
+++ b/fix-CVE-2026-58058.patch
@@ -0,0 +1,28 @@
+From bb6754e76bb1686315008e1aa1c40202a513fb83 Mon Sep 17 00:00:00 2001
+From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
+Date: Thu, 25 Jun 2026 21:58:49 +0000
+Subject: [PATCH] Fix extension header parsing. Credit: Himanshu Anand
+
+---
+ libnetutil/netutil.cc | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/libnetutil/netutil.cc b/libnetutil/netutil.cc
+index 5a2daf187f..ba7cfe71a0 100644
+--- a/libnetutil/netutil.cc
++++ b/libnetutil/netutil.cc
+@@ -700,11 +700,13 @@ static const u8 *ipv6_get_data_primitive(const struct ip6_hdr *ip6, const u8 *pa
+   *nxt = ip6->ip6_nxt;
+   p += sizeof(*ip6);
+   while (p < end && ipv6_is_extension_header(*nxt)) {
+-    if (p + 2 > end)
++    if (p + 8 > end)
+       return NULL;
+     *nxt = *p;
+     p += (*(p + 1) + 1) * 8;
+   }
++  if (p >= end)
++    return NULL;
+ 
+   *len = end - p;
+   if (upperlayer_only && !ipv6_is_upperlayer(*nxt))
diff --git a/nmap-7.94.tar.bz2 b/nmap-7.94.tar.bz2
deleted file mode 100644
index 1ceb39c686520d04c496c8312c3528eda5c3353e..0000000000000000000000000000000000000000
Binary files a/nmap-7.94.tar.bz2 and /dev/null differ
diff --git a/nmap.spec b/nmap.spec
index fde96355fe6229616f1b5ae1c29d9a7370c9488e..4d1143898e9fbb732df8197609f257d2b4cd87cd 100644
--- a/nmap.spec
+++ b/nmap.spec
@@ -1,4 +1,4 @@
-%define anolis_release 1
+%define anolis_release 2
 %global _hardened_build 1
 
 %bcond_without pcre
@@ -12,6 +12,8 @@ URL: http://nmap.org/
 # Uses combination of licenses based on GPL license, but with extra modification
 License: Nmap
 Source0: http://nmap.org/dist/%{name}-%{version}.tar.bz2
+# https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83
+Patch1: fix-CVE-2026-58058.patch
 
 BuildRequires: automake make
 BuildRequires: autoconf
@@ -182,6 +184,9 @@ fi
 %doc ncat/docs/AUTHORS ncat/docs/README ncat/docs/THANKS ncat/docs/examples
 
 %changelog
+* Wed Aug 05 2026 ali-inspur <shenzhongli@inspur.com> - 3:7.94-2
+- Fix CVE-2026-58058
+
 * Sun May 21 2023 Funda Wang <fundawang@yeah.net> - 3:7.94-1
 - New version 3.94
 - Enable ndiff and zenmap as they are python3 compatible