diff --git a/backport-CVE-2021-3671.patch b/backport-CVE-2021-3671.patch
new file mode 100644
index 0000000000000000000000000000000000000000..1e53b4bd6ac41fc0f55ec1b3493e4de369352ab3
--- /dev/null
+++ b/backport-CVE-2021-3671.patch
@@ -0,0 +1,39 @@
+From 0cb4b939f192376bf5e33637863a91a20f74c5a5 Mon Sep 17 00:00:00 2001
+From: Luke Howard <lukeh@padl.com>
+Date: Fri, 27 Aug 2021 11:42:48 +1000
+Subject: [PATCH] CVE-2021-3671 HEIMDAL kdc: validate sname in TGS-REQ
+
+In tgs_build_reply(), validate the server name in the TGS-REQ is present before
+dereferencing.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770
+
+[abartlet@samba.org backported from from Heimdal
+commit 04171147948d0a3636bc6374181926f0fb2ec83a via reference
+to an earlier patch by Joseph Sutton]
+
+RN: An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ
+
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/heimdal/kdc/krb5tgs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c
+index b76726cdd64..d143eb739eb 100644
+--- a/source4/heimdal/kdc/krb5tgs.c
++++ b/source4/heimdal/kdc/krb5tgs.c
+@@ -1603,6 +1603,10 @@ tgs_build_reply(krb5_context context,
+ 
+ 	s = &adtkt.cname;
+ 	r = adtkt.crealm;
++    } else if (s == NULL) {
++	ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
++	krb5_set_error_message(context, ret, "No server in request");
++	goto out;
+     }
+ 
+     _krb5_principalname2krb5_principal(context, &sp, *s, r);
+-- 
+GitLab
+
diff --git a/samba.spec b/samba.spec
index 78448f9d08a969b71e55ad173d9c4c44fcf728b4..3b18bd3af3834355057e40b1dc8fb4b0386c273f 100644
--- a/samba.spec
+++ b/samba.spec
@@ -49,7 +49,7 @@
 
 Name:           samba
 Version:        4.11.12
-Release:        4
+Release:        5
 
 Summary:        A suite for Linux to interoperate with Windows
 License:        GPLv3+ and LGPLv3+
@@ -74,6 +74,7 @@ Patch4:         CVE-2020-1472.patch
 Patch5:         CVE-2021-20277.patch
 Patch6:         CVE-2020-27840.patch
 Patch7:         CVE-2021-20254.patch
+Patch8:         backport-CVE-2021-3671.patch
 
 BuildRequires: avahi-devel cups-devel dbus-devel docbook-style-xsl e2fsprogs-devel gawk gnupg2 gnutls-devel >= 3.4.7 gpgme-devel
 BuildRequires: jansson-devel krb5-devel >= %{required_mit_krb5} libacl-devel libaio-devel libarchive-devel libattr-devel 
@@ -3061,6 +3062,12 @@ fi
 %{_mandir}/man*
 
 %changelog
+* Mon Oct 25 2021 gaihuiying <gaihuiying1@huawei.com> - 4.11.12-5
+- Type:cves
+- ID:CVE-2021-3671
+- SUG:NA
+- DESC:fix CVE-2021-3671
+
 * Wed May 26 2021 gaihuiying <gaihuiying1@huawei.com> - 4.11.12-4
 - Type:cves
 - ID:CVE-2020-27840 CVE-2021-20277 CVE-2021-20254