diff --git a/release-3.8.0-1.tar.gz b/release-3.8.0-1.tar.gz
deleted file mode 100644
index 053abd9..0000000
Binary files a/release-3.8.0-1.tar.gz and /dev/null differ
diff --git a/release-3.9.1.tar.gz b/release-3.9.1.tar.gz
new file mode 100644
index 0000000..6d932ce
Binary files /dev/null and b/release-3.9.1.tar.gz differ
diff --git a/xmvn-reactor b/xmvn-reactor
index 2df9403..aea30db 100644
--- a/xmvn-reactor
+++ b/xmvn-reactor
@@ -4,8 +4,8 @@
     <artifact>
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper</artifactId>
-      <version>3.8.0</version>
-      <path>absolute-prefix/zookeeper-server/target/zookeeper-3.8.0.jar</path>
+      <version>3.9.1</version>
+      <path>absolute-prefix/zookeeper-server/target/zookeeper-3.9.1.jar</path>
       <properties>
         <type>jar</type>
         <requiresJava>1.6</requiresJava>
@@ -15,7 +15,7 @@
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper</artifactId>
       <extension>pom</extension>
-      <version>3.8.0</version>
+      <version>3.9.1</version>
       <path>absolute-prefix/zookeeper-server/pom.xml</path>
       <properties>
         <type>jar</type>
@@ -26,8 +26,8 @@
     <artifact>
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-jute</artifactId>
-      <version>3.8.0</version>
-      <path>absolute-prefix/zookeeper-jute/target/zookeeper-jute-3.8.0.jar</path>
+      <version>3.9.1</version>
+      <path>absolute-prefix/zookeeper-jute/target/zookeeper-jute-3.9.1.jar</path>
       <properties>
         <type>jar</type>
         <requiresJava>1.6</requiresJava>
@@ -37,7 +37,7 @@
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-jute</artifactId>
       <extension>pom</extension>
-      <version>3.8.0</version>
+      <version>3.9.1</version>
       <path>absolute-prefix/zookeeper-jute/pom.xml</path>
       <properties>
         <type>jar</type>
@@ -48,8 +48,8 @@
     <artifact>
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-prometheus-metrics</artifactId>
-      <version>3.8.0</version>
-      <path>absolute-prefix/zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/zookeeper-prometheus-metrics-3.8.0.jar</path>
+      <version>3.9.1</version>
+      <path>absolute-prefix/zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/zookeeper-prometheus-metrics-3.9.1.jar</path>
       <properties>
         <type>jar</type> 
         <requiresJava>1.6</requiresJava>
@@ -59,7 +59,7 @@
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-prometheus-metrics</artifactId>
       <extension>pom</extension>
-      <version>3.8.0</version>
+      <version>3.9.1</version>
       <path>absolute-prefix/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml</path> 
       <properties> 
         <type>jar</type>
diff --git a/zookeeper.spec b/zookeeper.spec
index a185aaf..3407b1f 100644
--- a/zookeeper.spec
+++ b/zookeeper.spec
@@ -1,4 +1,4 @@
-%define rel_ver 3.8.0
+%define rel_ver 3.9.1
 %define pkg_ver 1
 %define _prefix /opt/zookeeper
 %global debug_package %{nil}
@@ -10,7 +10,7 @@ Release: %{pkg_ver}
 License: Apache-2.0 and OpenSSL and SSLeay and MIT and BSD
 Group: Applications/Databases
 URL: https://www.apache.org/dist/zookeeper/
-Source0: https://github.com/apache/zookeeper/archive/refs/tags/release-3.8.0-1.tar.gz
+Source0: https://github.com/apache/zookeeper/archive/refs/tags/release-%{rel_ver}.tar.gz
 Source1: zoo.cfg
 Source2: zookeeper.service
 Source3: zookeeper.sysconfig
@@ -26,7 +26,7 @@ Provides: mvn(org.apche.zookeeper:zookeeper)
 ZooKeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services.
 
 %prep
-%setup -q -n zookeeper-release-%{version}-1
+%setup -q -n zookeeper-release-%{version}
 cp %{SOURCE5} ./.xmvn-reactor
 echo `pwd` > absolute_prefix.log
 sed -i 's/\//\\\//g' absolute_prefix.log
@@ -82,6 +82,9 @@ exit 0
 %systemd_postun_with_restart zookeeper.service
 
 %changelog
+* Tue Nov 28 2023 xiexing <xiexing4@hisilicon.com> - 3.9.1-1
+- update version 3.9.1 to fix CVE-2023-44981
+
 * Thu May 5 2022 xiexing <xiexing4@hisilicon.com> - 3.8.0-1
 - update version