diff --git a/0001-avahi-client-fix-resource-leak.patch b/0001-avahi-client-fix-resource-leak.patch
new file mode 100644
index 0000000..1016036
--- /dev/null
+++ b/0001-avahi-client-fix-resource-leak.patch
@@ -0,0 +1,25 @@
+From 374245ec1418e7e1e57120fcaf0a12ec695f5f6d Mon Sep 17 00:00:00 2001
+From: Michal Sekletar <msekleta@redhat.com>
+Date: Wed, 24 Oct 2018 15:22:19 +0000
+Subject: [PATCH] avahi-client: fix resource leak
+
+---
+ avahi-client/browser.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/avahi-client/browser.c b/avahi-client/browser.c
+index c978d94..fa4a9a8 100644
+--- a/avahi-client/browser.c
++++ b/avahi-client/browser.c
+@@ -72,6 +72,8 @@ static void parse_domain_file(AvahiDomainBrowser *b) {
+         if (avahi_normalize_name(buf, domain, sizeof(domain)))
+             b->static_browse_domains = avahi_string_list_add(b->static_browse_domains, domain);
+     }
++
++    fclose(f);
+ }
+ 
+ static void domain_browser_ref(AvahiDomainBrowser *db) {
+-- 
+2.39.3 (Apple Git-146)
+
diff --git a/0001-avahi-core-rearrange-deallocations-in-avahi_time_eve.patch b/0001-avahi-core-rearrange-deallocations-in-avahi_time_eve.patch
new file mode 100644
index 0000000..853d6c9
--- /dev/null
+++ b/0001-avahi-core-rearrange-deallocations-in-avahi_time_eve.patch
@@ -0,0 +1,31 @@
+From bf92dbc2c0cb39b4c970dcf700254ab5293b3756 Mon Sep 17 00:00:00 2001
+From: Evgeny Vereshchagin <evvers@ya.ru>
+Date: Mon, 5 Dec 2022 20:17:42 +0000
+Subject: [PATCH] avahi-core: rearrange deallocations in
+ avahi_time_event_queue_new a bit
+
+Reported by Coverity Scan.
+---
+ avahi-core/timeeventq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/avahi-core/timeeventq.c b/avahi-core/timeeventq.c
+index 2799bf2..beceaff 100644
+--- a/avahi-core/timeeventq.c
++++ b/avahi-core/timeeventq.c
+@@ -135,10 +135,10 @@ AvahiTimeEventQueue* avahi_time_event_queue_new(const AvahiPoll *poll_api) {
+ oom:
+ 
+     if (q) {
+-        avahi_free(q);
+-
+         if (q->prioq)
+             avahi_prio_queue_free(q->prioq);
++
++        avahi_free(q);
+     }
+ 
+     return NULL;
+-- 
+2.39.3 (Apple Git-146)
+
diff --git a/avahi.spec b/avahi.spec
index 7767574..b837d13 100644
--- a/avahi.spec
+++ b/avahi.spec
@@ -157,6 +157,8 @@ Patch11: 0011-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch
 Patch16: 0016-Fix-NULL-pointer-crashes-from-175.patch
 # https://github.com/lathiat/avahi/pull/407
 Patch17: 0017-Emit-error-if-requested-service-is-not-found.patch
+Patch18: 0001-avahi-client-fix-resource-leak.patch
+Patch19: 0001-avahi-core-rearrange-deallocations-in-avahi_time_eve.patch
 
 ## downstream patches
 Patch100: avahi-0.6.30-mono-libdir.patch
@@ -884,6 +886,7 @@ exit 0
 %changelog
 * Thu Aug 22 2024 Michal Sekletar <msekleta@redhat.com> - 0.8-29
 - fix file attributes of /run/avahi-daemon (RHEL-55762)
+- fix SAST issues (RHEL-40016)
 
 * Thu Jun 27 2024 Tomas Popela <tpopela@redhat.com> - 0.8-28
 - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead