diff --git a/buildah.spec b/buildah.spec
index 59e2928..aaa2cff 100644
--- a/buildah.spec
+++ b/buildah.spec
@@ -12,13 +12,13 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl
 
 %global import_path github.com/containers/buildah
 %global branch release-1.33
-%global commit0 58af1cdf16e3cdcdf2e885b570c1fa5d04857c3a
+%global commit0 cf49e7c062abd192ccbbe8ae336c6ef3c00dcefb
 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
 Epoch: 2
 Name: buildah
 Version: 1.33.12
-Release: 1%{?dist}
+Release: 2%{?dist}
 Summary: A command line tool used for creating OCI Images
 License: ASL 2.0
 URL: https://%{name}.io
@@ -136,6 +136,12 @@ make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
 %{_datadir}/%{name}/test
 
 %changelog
+* Tue May 06 2025 Jindrich Novy <jnovy@redhat.com> - 2:1.33.12-2
+- update to the latest content of https://github.com/containers/buildah/tree/release-1.33
+  (https://github.com/containers/buildah/commit/cf49e7c)
+- fixes "CVE-2025-22871 container-tools:rhel8/buildah: Request smuggling due to acceptance of invalid chunked data in net/http [rhel-8.10.z]"
+- Resolves: RHEL-89239
+
 * Fri Jan 24 2025 Jindrich Novy <jnovy@redhat.com> - 2:1.33.12-1
 - update to the latest content of https://github.com/containers/buildah/tree/release-1.33
   (https://github.com/containers/buildah/commit/58af1cd)
diff --git a/sources b/sources
index b972c06..13653f1 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (release-1.33-58af1cd.tar.gz) = 112f1002ff1ea33f5a13fb30622b618db609e8eee369edcb992c9f549fc689bfeaba87eac93127d9671d6b4bf79092980c4b4b38e7f67e3598035e7db7251e7e
+SHA512 (release-1.33-cf49e7c.tar.gz) = ccb9d72e6abf18c7a0e2a3dfca65f6787c51e288656a390f6874cdd8f9e628abc92bd678abda498782f207c3c44a9f8bfeb4b7acc73d42f87d6cbb6ddbd0ff39