diff --git a/release-3.9.1.tar.gz b/release-3.9.1.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..6d932ced8b3cf30221e2f2f97dee832222e5571a
Binary files /dev/null and b/release-3.9.1.tar.gz differ
diff --git a/xmvn-reactor b/xmvn-reactor
index 78cd6bfd72be3f92a3c355025c0a3d633cbc6c18..aea30db77e59fc1fcc86c9e92b2bb1dc92da1f04 100644
--- a/xmvn-reactor
+++ b/xmvn-reactor
@@ -4,8 +4,8 @@
     <artifact>
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper</artifactId>
-      <version>3.6.2</version>
-      <path>absolute-prefix/zookeeper-server/target/zookeeper-3.6.2.jar</path>
+      <version>3.9.1</version>
+      <path>absolute-prefix/zookeeper-server/target/zookeeper-3.9.1.jar</path>
       <properties>
         <type>jar</type>
         <requiresJava>1.6</requiresJava>
@@ -15,7 +15,7 @@
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper</artifactId>
       <extension>pom</extension>
-      <version>3.6.2</version>
+      <version>3.9.1</version>
       <path>absolute-prefix/zookeeper-server/pom.xml</path>
       <properties>
         <type>jar</type>
@@ -26,8 +26,8 @@
     <artifact>
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-jute</artifactId>
-      <version>3.6.2</version>
-      <path>absolute-prefix/zookeeper-jute/target/zookeeper-jute-3.6.2.jar</path>
+      <version>3.9.1</version>
+      <path>absolute-prefix/zookeeper-jute/target/zookeeper-jute-3.9.1.jar</path>
       <properties>
         <type>jar</type>
         <requiresJava>1.6</requiresJava>
@@ -37,7 +37,7 @@
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-jute</artifactId>
       <extension>pom</extension>
-      <version>3.6.2</version>
+      <version>3.9.1</version>
       <path>absolute-prefix/zookeeper-jute/pom.xml</path>
       <properties>
         <type>jar</type>
@@ -48,8 +48,8 @@
     <artifact>
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-prometheus-metrics</artifactId>
-      <version>3.6.2</version>
-      <path>absolute-prefix/zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/zookeeper-prometheus-metrics-3.6.2.jar</path>
+      <version>3.9.1</version>
+      <path>absolute-prefix/zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/zookeeper-prometheus-metrics-3.9.1.jar</path>
       <properties>
         <type>jar</type> 
         <requiresJava>1.6</requiresJava>
@@ -59,7 +59,7 @@
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-prometheus-metrics</artifactId>
       <extension>pom</extension>
-      <version>3.6.2</version>
+      <version>3.9.1</version>
       <path>absolute-prefix/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml</path> 
       <properties> 
         <type>jar</type>
diff --git a/zookeeper.spec b/zookeeper.spec
index a427dc562fb48cca8952dd99e212ed5a3b0c6159..22e9e5cd5eac44c31eff700df0ef3bb923c78d88 100644
--- a/zookeeper.spec
+++ b/zookeeper.spec
@@ -1,6 +1,7 @@
-%define rel_ver 3.6.2
-%define pkg_ver 2.4
+%define rel_ver 3.9.1
+%define pkg_ver 1
 %define _prefix /opt/zookeeper
+%global debug_package %{nil}
 
 Summary: High-performance coordination service for distributed applications.
 Name: zookeeper
@@ -9,8 +10,7 @@ Release: %{pkg_ver}
 License: Apache-2.0 and OpenSSL and SSLeay and MIT and BSD
 Group: Applications/Databases
 URL: https://www.apache.org/dist/zookeeper/
-BuildArch: noarch
-Source0: zookeeper-release-%{rel_ver}.tar.gz
+Source0: https://github.com/apache/zookeeper/archive/refs/tags/release-%{rel_ver}.tar.gz
 Source1: zoo.cfg
 Source2: zookeeper.service
 Source3: zookeeper.sysconfig
@@ -82,6 +82,9 @@ exit 0
 %systemd_postun_with_restart zookeeper.service
 
 %changelog
+* Tue Dec 15 2023 xiexing <xiexing4@hisilicon.com> - 3.9.1-1
+- update version 3.9.1 to fix CVE-2023-44981
+
 * Mon Feb 14 2022 xu_ping <xuping33@huawei.com> - 2.4
 - Add systemd to buildrequires because %{_unitdir} can't recognize