diff --git a/0001-scheduler-Fix-possible-use_after_free-in-cupsdReadCl.patch b/0001-scheduler-Fix-possible-use_after_free-in-cupsdReadCl.patch
new file mode 100644
index 0000000..3b84753
--- /dev/null
+++ b/0001-scheduler-Fix-possible-use_after_free-in-cupsdReadCl.patch
@@ -0,0 +1,29 @@
+From c1d2c631267f28131dd31df5b895b8bfb3005b0d Mon Sep 17 00:00:00 2001
+From: Zdenek Dohnal <zdohnal@redhat.com>
+Date: Thu, 11 Dec 2025 15:12:55 +0100
+Subject: [PATCH] scheduler: Fix possible use_after_free in `cupsdReadClient()`
+
+If `cupsdSendHeader()` fails, we free the connection and return -1, but
+in that case we try to free the connection again in `cupsdReadClient()`.
+---
+ scheduler/client.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/scheduler/client.c b/scheduler/client.c
+index f6166091e..63844d531 100644
+--- a/scheduler/client.c
++++ b/scheduler/client.c
+@@ -2761,10 +2761,7 @@ check_start_tls(cupsd_client_t *con)	/* I - Client connection */
+     httpSetField(con->http, HTTP_FIELD_CONTENT_LENGTH, "0");
+ 
+     if (!cupsdSendHeader(con, HTTP_STATUS_OK, NULL, CUPSD_AUTH_NONE))
+-    {
+-      cupsdCloseClient(con);
+       return (-1);
+-    }
+   }
+ 
+   return (1);
+-- 
+2.52.0
+
diff --git a/cups.spec b/cups.spec
index 33feecf..ca4896c 100644
--- a/cups.spec
+++ b/cups.spec
@@ -22,7 +22,7 @@ Summary: CUPS printing system
 Name: cups
 Epoch: 1
 Version: 2.4.10
-Release: 15%{?dist}
+Release: 16%{?dist}
 # backend/failover.c - BSD-3-Clause
 # cups/md5* - Zlib
 # scheduler/colorman.c - Apache-2.0 WITH LLVM-exception AND BSD-2-Clause
@@ -124,6 +124,9 @@ Patch1019: 0001-Fix-an-infinite-loop-issue-in-GTK-Issue-1439.patch
 # 0001-conf.c-Fix-stopping-scheduler-on-unknown-directive.patch
 Patch1020: 0001-Fix-various-issues-in-cupsd.patch
 Patch1021: 0001-conf.c-Fix-stopping-scheduler-on-unknown-directive.patch
+# fix use-after-free reported after fix for CVE-2025-58436
+# https://github.com/OpenPrinting/cups/pull/1454
+Patch1022: 0001-scheduler-Fix-possible-use_after_free-in-cupsdReadCl.patch
 
 
 ##### Patches removed because IMHO they aren't no longer needed
@@ -396,6 +399,8 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in
 # RHEL-129716 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues
 %patch -P 1020 -p1 -b .config-issues
 %patch -P 1021 -p1 -b .ignore-unknown
+# fix use-after-free reported after fix for CVE-2025-58436
+%patch -P 1022 -p1 -b .osh-use-after-free
 
 
 # Log to the system journal by default (bug #1078781, bug #1519331).
@@ -867,6 +872,9 @@ rm -f %{cups_serverbin}/backend/smb
 %{_mandir}/man7/ippeveps.7.gz
 
 %changelog
+* Fri Dec 12 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-16
+- fix use-after-free reported by OSH
+
 * Thu Nov 27 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-15
 - RHEL-129723 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
 - RHEL-129716 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues