diff --git a/qemu.spec b/qemu.spec
index 0e3d75d..55f20bc 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -566,6 +566,8 @@ Patch0553: bootp-check-bootp_input-buffer-size.patch
 Patch0554: upd6-check-udp6_input-buffer-size.patch
 Patch0555: tftp-check-tftp_input-buffer-size.patch
 Patch0556: tftp-introduce-a-header-structure.patch
+Patch0557: fix-cve-2020-35504.patch
+Patch0558: fix-cve-2020-35505.patch
 
 BuildRequires: flex
 BuildRequires: gcc
@@ -970,6 +972,10 @@ getent passwd qemu >/dev/null || \
 %endif
 
 %changelog
+* Tue Dec 21 2021 Chen Qun <kuhn.chenqun@huawei.com>
+- fix cve-2020-35504
+- fix cve-2020-35505
+
 * Tue Oct 26 2021 imxcc <xingchaochao@huawei.com>
 - fix cve-2021-3592 cve-2021-3593 cve-2021-3595