diff --git a/CVE-2022-34169.patch b/CVE-2022-34169.patch
new file mode 100644
index 0000000000000000000000000000000000000000..baf5413f37f3b23f3c0761cbbfd30f4ef2510600
--- /dev/null
+++ b/CVE-2022-34169.patch
@@ -0,0 +1,85 @@
+From 13bf52c8d876528a43be7cb77a1f452d29a21492 Mon Sep 17 00:00:00 2001
+From: Aleksei Voitylov <avoitylov@openjdk.org>
+Date: Mon, 30 May 2022 12:26:00 +0000
+Subject: [PATCH] 8285407: Improve Xalan supports
+
+Refer: https://github.com/openjdk/jdk11u/commit/13bf52c8d876528a43be7cb77a1f452d29a21492
+---
+ .../org/apache/bcel/classfile/ConstantPool.java    | 12 ++++++++++--
+ .../org/apache/bcel/generic/ConstantPoolGen.java   | 14 ++++++++++++--
+ 2 files changed, 22 insertions(+), 4 deletions(-)
+
+diff --git a/src/main/java/org/apache/bcel/classfile/ConstantPool.java b/src/main/java/org/apache/bcel/classfile/ConstantPool.java
+index c8bc32a..9e465c6 100644
+--- a/src/main/java/org/apache/bcel/classfile/ConstantPool.java
++++ b/src/main/java/org/apache/bcel/classfile/ConstantPool.java
+@@ -22,6 +22,7 @@ import java.io.DataOutputStream;
+ import java.io.IOException;
+ 
+ import org.apache.bcel.Const;
++import org.apache.bcel.generic.ConstantPoolGen;
+ 
+ /**
+  * This class represents the constant pool, i.e., a table of constants, of
+@@ -218,8 +219,15 @@ public class ConstantPool implements Cloneable, Node {
+      * @throws IOException
+      */
+     public void dump( final DataOutputStream file ) throws IOException {
+-        file.writeShort(constant_pool.length);
+-        for (int i = 1; i < constant_pool.length; i++) {
++       /*
++        *  Constants over the size of the constant pool shall not be written out.
++        *  This is a redundant measure as the ConstantPoolGen should have already
++        *  reported an error back in the situation.
++        */
++	int size = constant_pool.length < ConstantPoolGen.CONSTANT_POOL_SIZE - 1 ?
++                    constant_pool.length : ConstantPoolGen.CONSTANT_POOL_SIZE - 1;
++        file.writeShort(size);
++        for (int i = 1; i < size; i++) {
+             if (constant_pool[i] != null) {
+                 constant_pool[i].dump(file);
+             }
+diff --git a/src/main/java/org/apache/bcel/generic/ConstantPoolGen.java b/src/main/java/org/apache/bcel/generic/ConstantPoolGen.java
+index f3a766e..9c7f252 100644
+--- a/src/main/java/org/apache/bcel/generic/ConstantPoolGen.java
++++ b/src/main/java/org/apache/bcel/generic/ConstantPoolGen.java
+@@ -52,6 +52,7 @@ import org.apache.bcel.classfile.ConstantUtf8;
+ public class ConstantPoolGen {
+ 
+     private static final int DEFAULT_BUFFER_SIZE = 256;
++    public static final int CONSTANT_POOL_SIZE = 65536;
+ 
+     /**
+      * @deprecated (since 6.0) will be made private; do not access directly, use getter/setter
+@@ -95,7 +96,7 @@ public class ConstantPoolGen {
+     public ConstantPoolGen(final Constant[] cs) {
+         final StringBuilder sb = new StringBuilder(DEFAULT_BUFFER_SIZE);
+ 
+-        size = Math.max(DEFAULT_BUFFER_SIZE, cs.length + 64);
++        size = Math.min(cs.length, CONSTANT_POOL_SIZE);
+         constants = new Constant[size];
+ 
+         System.arraycopy(cs, 0, constants, 0, cs.length);
+@@ -224,9 +225,18 @@ public class ConstantPoolGen {
+     /** Resize internal array of constants.
+      */
+     protected void adjustSize() {
+-        if (index + 3 >= size) {
++        // 3 extra spaces are needed as some entries may take 3 slots
++        if (index + 3 >= CONSTANT_POOL_SIZE) {
++            throw new RuntimeException("The number of constants " + (index + 3)
++                  + " is over the size of the constant pool: "
++                  + (CONSTANT_POOL_SIZE - 1));
++        }
++
++	if (index + 3 >= size) {
+             final Constant[] cs = constants;
+             size *= 2;
++            // the constant array shall not exceed the size of the constant pool
++            size = Math.min(size, CONSTANT_POOL_SIZE);
+             constants = new Constant[size];
+             System.arraycopy(cs, 0, constants, 0, index);
+         }
+-- 
+2.27.0
+
diff --git a/bcel.spec b/bcel.spec
index 99f8715a6c4dd7ec0e626ba104152d8256fef44d..186c5acea5cc08f6cb10408d6a6ccb17c248822e 100644
--- a/bcel.spec
+++ b/bcel.spec
@@ -1,10 +1,11 @@
 Name:           bcel
 Version:        6.2
-Release:        4
+Release:        5
 Summary:        Byte Code Engineering Library
 License:        ASL 2.0
 URL:            http://commons.apache.org/proper/commons-bcel/
 Source0:        http://archive.apache.org/dist/commons/bcel/source/bcel-%{version}-src.tar.gz
+Patch0:         CVE-2022-34169.patch
 BuildArch:      noarch
 BuildRequires:  maven-local mvn(org.apache.commons:commons-parent:pom:) mvn(junit:junit)
 BuildRequires:  mvn(net.java.dev.jna:jna) mvn(net.java.dev.jna:jna-platform) mvn(org.apache.commons:commons-lang3)
@@ -17,7 +18,7 @@ give users a convenient possibility to analyze, create, and manipulate (binary)
 Java class files (those ending with .class).
 
 %prep
-%autosetup -n %{name}-%{version}-src
+%autosetup -n %{name}-%{version}-src -p1
 %pom_remove_plugin :maven-source-plugin
 %mvn_alias : bcel: apache:
 %mvn_file : %{name}
@@ -37,5 +38,8 @@ Java class files (those ending with .class).
 %{_javadocdir}/%{name}
 
 %changelog
+* Fri Sep 23 2022 wangkai <wangkai385@h-partners.com> - 6.2-5
+- Fix CVE-2022-34169 for xalan-j2
+
 * Thu Dec 7 2019 openEuler Buildteam <buildteam@openeuler.org> - 6.2-4
 - Package init