diff --git a/CVE-2023-26552.patch b/CVE-2023-26552.patch
new file mode 100644
index 0000000000000000000000000000000000000000..aebcffd6f8864518b2e6a0d3b13810133000c58f
--- /dev/null
+++ b/CVE-2023-26552.patch
@@ -0,0 +1,30 @@
+diff -up ntp-4.2.8p15/libntp/mstolfp.c.orig ntp-4.2.8p15/libntp/mstolfp.c
+--- ntp-4.2.8p15/libntp/mstolfp.c.orig  2020-03-04 00:41:29.000000000 +0100
++++ ntp-4.2.8p15/libntp/mstolfp.c       2023-04-20 14:13:52.944003519 +0200
+@@ -14,7 +14,7 @@ mstolfp(
+        l_fp *lfp
+        )
+ {
+-       register const char *cp;
++       register const char *cp, *end;
+        register char *bp;
+        register const char *cpdec;
+        char buf[100];
+@@ -42,6 +42,15 @@ mstolfp(
+        if (*cp != '.' && !isdigit((unsigned char)*cp))
+            return 0;
+-
++
++       /*
++        * Make sure the buffer has enough room for the input string and the
++        * extra characters, in the worst case replacing "." with "0.000"
++        */
++       end = cp;
++       while (isdigit((unsigned char)*end) || *end == '.')
++           end++;
++       if (end - cp + 4 >= sizeof (buf) - (bp - buf))
++           return 0;
+-
++
+        /*
+         * Search forward for the decimal point or the end of the string.
diff --git a/ntp.spec b/ntp.spec
index 2943174d8fc5e5fb9c425822465d720135e81daf..929656f2c513e53a3402a0aff83cf5274a552b2f 100644
--- a/ntp.spec
+++ b/ntp.spec
@@ -2,7 +2,7 @@
 
 Name:                  ntp
 Version:               4.2.8p15
-Release:               4
+Release:               5
 Summary:               A protocol designed to synchronize the clocks of computers over a network
 License:               MIT and BSD and BSD with advertising
 URL:                   https://www.ntp.org/
@@ -31,6 +31,7 @@ BuildRequires:         autogen autogen-libopts-devel systemd gcc perl-generators
 Requires(pre):         shadow-utils autogen >= 5.18.16
 %{?systemd_requires}
 Recommends:            ntpstat timedatex
+Requires:              %{name}-help
 Provides:              ntpdate sntp
 Obsoletes:             ntpdate sntp
 
@@ -207,6 +208,12 @@ make check
 %{_mandir}/man8/*.8*
 
 %changelog
+* Thu Dec 9 2021 renmingshuai<renmingshuai@huawei.com> - 4.2.8p15-5
+- Type:requirement
+- ID:NA
+- SUG:NA
+- DESC:add ntp-help dependency for ntp
+
 * Tue Aug 10 2021 renmingshuai<renmingshuai@huawei.com> - 4.2.8p15-4
 - Type:bugfix
 - ID:NA