diff --git a/CVE-2025-58060.patch b/CVE-2025-58060.patch
new file mode 100644
index 0000000..3720847
--- /dev/null
+++ b/CVE-2025-58060.patch
@@ -0,0 +1,35 @@
+diff --git a/scheduler/auth.c b/scheduler/auth.c
+index e7d0006..d70e21e 100644
+--- a/scheduler/auth.c
++++ b/scheduler/auth.c
+@@ -564,8 +564,12 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
+     switch (type)
+     {
+       default :
++	  {
++	    cupsdLogClient(con, CUPSD_LOG_ERROR, "Basic authentication is not enabled.");
++	    return;
++	  }
+       case CUPSD_AUTH_BASIC :
+-          {
++	  {
+ #if HAVE_LIBPAM
+ 	   /*
+ 	    * Only use PAM to do authentication.  This supports MD5
+@@ -737,6 +741,16 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
+     gss_name_t		client_name;	/* Client name */
+ 
+ 
++   /*
++    * Only allow Kerberos if enabled...
++    */
++
++    if (type != CUPSD_AUTH_NEGOTIATE)
++    {
++      cupsdLogClient(con, CUPSD_LOG_ERROR, "Kerberos authentication is not enabled.");
++      return;
++    }
++
+ #  ifdef __APPLE__
+    /*
+     * If the weak-linked GSSAPI/Kerberos library is not present, don't try
diff --git a/cups.spec b/cups.spec
index a2b08f0..749397d 100644
--- a/cups.spec
+++ b/cups.spec
@@ -24,7 +24,7 @@ Summary: CUPS printing system
 Name: cups
 Epoch: 1
 Version: 2.3.3%{OP_VER}
-Release: 33%{?dist}
+Release: 34%{?dist}
 License: ASL 2.0
 Url: http://www.cups.org/
 # Apple stopped uploading the new versions into github, use OpenPrinting fork
@@ -161,6 +161,8 @@ Patch49: 0001-fix-warnings-for-unused-vars.patch
 #          0001-Add-NoSystem-SSLOptions-value.patch
 Patch50: 0001-tls-gnutls.c-Use-system-crypto-policy-if-available.patch
 Patch51: 0001-Add-NoSystem-SSLOptions-value.patch
+# RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
+Patch52: CVE-2025-58060.patch
 
 
 ##### Patches removed because IMHO they aren't no longer needed
@@ -448,6 +450,8 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in
 # RHEL-68414 Inability to disable weak ciphers in CUPS configuration
 %patch50 -p1 -b .tls-system
 %patch51 -p1 -b .ssl-nosystem
+# RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
+%patch52 -p1 -b .cve-2025-58060
 
 
 %if %{lspp}
@@ -913,6 +917,9 @@ rm -f %{cups_serverbin}/backend/smb
 %{_mandir}/man7/ippeveps.7.gz
 
 %changelog
+* Thu Sep 11 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1.2.3.3op2-34
+- RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
+
 * Wed Jan 08 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-33
 - Add NoSystem SSLOptions value