diff --git a/expat-2.4.4.tar.gz b/expat-2.4.4.tar.gz
deleted file mode 100644
index 8be876c..0000000
Binary files a/expat-2.4.4.tar.gz and /dev/null differ
diff --git a/expat-2.4.6.tar.gz b/expat-2.4.6.tar.gz
new file mode 100644
index 0000000..6b4c850
Binary files /dev/null and b/expat-2.4.6.tar.gz differ
diff --git a/expat.spec b/expat.spec
index 8f18a94..04d45e9 100644
--- a/expat.spec
+++ b/expat.spec
@@ -1,6 +1,6 @@
 %define Rversion %(echo %{version} | sed -e 's/\\./_/g' -e 's/^/R_/')
 Name:           expat
-Version:        2.4.4
+Version:        2.4.6
 Release:        1
 Summary:        An XML parser library
 License:        MIT
@@ -59,6 +59,10 @@ make check
 %{_mandir}/man1/*
 
 %changelog
+* Sat Feb 26 2022 yangzhuangzhuang <yangzhuangzhuang1@h-partners.com> - 2.4.6-1
+- update to 2.4.6
+- fix CVE-2022-25235 CVE-2022-25236 CVE-2022-25313 CVE-2022-25314 CVE-2022-25315
+
 * Mon Feb 7 2022 yangzhuangzhuang <yangzhuangzhuang1@h-partners.com> - 2.4.4-1
 - update to 2.4.4
 - fix CVE-2022-23852 CVE-2022-23990