diff --git a/backport-Avoid-Python-reference-leaks.patch b/backport-Avoid-Python-reference-leaks.patch
new file mode 100644
index 0000000000000000000000000000000000000000..6b70b45dd640dd606b8378a4c0549e529f511ac4
--- /dev/null
+++ b/backport-Avoid-Python-reference-leaks.patch
@@ -0,0 +1,61 @@
+From 70db7976d6ca0e6a4140269f21a66c14f6c177ab Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
+Date: Thu, 29 May 2025 17:31:45 +0200
+Subject: [PATCH] Avoid Python reference leaks
+
+---
+ python/rpmarchive-py.c | 11 +++++++++--
+ python/rpmfiles-py.c   |  1 +
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/python/rpmarchive-py.c b/python/rpmarchive-py.c
+index 626d868..b61f1b4 100644
+--- a/python/rpmarchive-py.c
++++ b/python/rpmarchive-py.c
+@@ -137,12 +137,16 @@ static PyObject *rpmarchive_readto(rpmarchiveObject *s,
+ 	return NULL;
+     }
+ 
+-    if (s->archive == NULL)
++    if (s->archive == NULL) {
++	Py_DECREF(fdo);
+ 	return rpmarchive_closed();
++    }
++
+ 
+     Py_BEGIN_ALLOW_THREADS
+     rc = rpmfiArchiveReadToFile(s->archive, rpmfdGetFd(fdo), nodigest);
+     Py_END_ALLOW_THREADS
++    Py_DECREF(fdo);
+ 
+     if (rc)
+ 	return rpmarchive_error(rc);
+@@ -162,12 +166,15 @@ static PyObject *rpmarchive_writeto(rpmarchiveObject *s,
+ 	return NULL;
+     }
+ 
+-    if (s->archive == NULL)
++    if (s->archive == NULL) {
++	Py_DECREF(fdo);
+ 	return rpmarchive_closed();
++    }
+ 
+     Py_BEGIN_ALLOW_THREADS
+     rc = rpmfiArchiveWriteFile(s->archive, rpmfdGetFd(fdo));
+     Py_END_ALLOW_THREADS
++    Py_DECREF(fdo);
+ 
+     if (rc)
+ 	return rpmarchive_error(rc);
+diff --git a/python/rpmfiles-py.c b/python/rpmfiles-py.c
+index 58ab2a9..21ee74c 100644
+--- a/python/rpmfiles-py.c
++++ b/python/rpmfiles-py.c
+@@ -486,6 +486,7 @@ static PyObject *rpmfiles_archive(rpmfilesObject *s,
+     } else {
+ 	archive = rpmfiNewArchiveReader(fd, s->files, RPMFI_ITER_READ_ARCHIVE);
+     }
++    Py_DECREF(fdo);
+ 
+     return rpmarchive_Wrap(&rpmarchive_Type, s->files, archive);
+ }
diff --git a/backport-Ensure-header-object-is-cleaned-even-in-case-of-an-error.patch b/backport-Ensure-header-object-is-cleaned-even-in-case-of-an-error.patch
new file mode 100644
index 0000000000000000000000000000000000000000..5e0a6dfd80280ad483d44e5f20371b66d84fa7f9
--- /dev/null
+++ b/backport-Ensure-header-object-is-cleaned-even-in-case-of-an-error.patch
@@ -0,0 +1,33 @@
+From 09a680763efef03151cfaf07dc71b6502b148138 Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
+Date: Thu, 26 Jun 2025 18:00:05 +0200
+Subject: [PATCH] Ensure header object is cleaned even in case of an error
+
+rpmReadPackageFile can set h even in case rpmrc is an error, which
+resulted in memory leaks.
+---
+ python/rpmts-py.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/python/rpmts-py.c b/python/rpmts-py.c
+index 95a40af..dd043c9 100644
+--- a/python/rpmts-py.c
++++ b/python/rpmts-py.c
+@@ -409,7 +409,7 @@ rpmts_HdrFromFdno(rpmtsObject * s, PyObject *arg)
+ {
+     PyObject *ho = NULL;
+     rpmfdObject *fdo = NULL;
+-    Header h;
++    Header h = NULL;
+     rpmRC rpmrc;
+ 
+     if (!PyArg_Parse(arg, "O&:HdrFromFdno", rpmfdFromPyObject, &fdo))
+@@ -420,7 +420,7 @@ rpmts_HdrFromFdno(rpmtsObject * s, PyObject *arg)
+     Py_END_ALLOW_THREADS;
+     Py_XDECREF(fdo);
+ 
+-    if (rpmrc == RPMRC_OK) {
++    if (h) {
+ 	ho = hdr_Wrap(&hdr_Type, h);
+     } else {
+ 	Py_INCREF(Py_None);
diff --git a/rpm.spec b/rpm.spec
index 86f5bd59e69eb791091eaf15235ba3225c3cacc7..cbda270282b5f79d9d9d34c4d5a65603cdd8640c 100644
--- a/rpm.spec
+++ b/rpm.spec
@@ -1,6 +1,6 @@
 Name:          rpm
 Version:       4.18.2
-Release:       24
+Release:       25
 Summary:       RPM Package Manager
 License:       GPL-2.0-or-later
 URL:           https://rpm.org/
@@ -61,6 +61,8 @@ Patch6038: backport-Fix-race-condition-in-rpmioMkpath.patch
 Patch6039: backport-Ignore-EPERM-for-root-when-setting-IMA-signature-xat.patch
 Patch6040: backport-Fix-a-copy-paste-help-description-of-rpmbuild-rf-and.patch
 Patch6041: backport-Return-1-from-fdSize-for-non-regular-files.patch
+Patch6042: backport-Avoid-Python-reference-leaks.patch
+Patch6043: backport-Ensure-header-object-is-cleaned-even-in-case-of-an-error.patch
 
 Patch9000: Add-digest-list-plugin.patch
 Patch9001: Add-IMA-digest-list-support.patch
@@ -349,6 +351,9 @@ make clean
 %exclude %{_mandir}/man8/rpmspec.8*
 
 %changelog
+* Thu Aug 14 2025 andy <liuyang01@kylinos.cn> - 4.18.2-25
+- sync patches form upstream
+
 * Wed Jul 2 2025 andy <liuyang01@kylinos.cn> - 4.18.2-24
 - sync patches form upstream