diff --git a/0006-curl-7.76.1-CVE-2021-22925.patch b/0006-curl-7.76.1-CVE-2021-22925.patch
new file mode 100644
index 0000000..769f74c
--- /dev/null
+++ b/0006-curl-7.76.1-CVE-2021-22925.patch
@@ -0,0 +1,47 @@
+From 3dbac7fb8b39a4f9aa871401d9d2790f0583ba01 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Sat, 12 Jun 2021 18:25:15 +0200
+Subject: [PATCH] telnet: fix option parser to not send uninitialized contents
+
+CVE-2021-22925
+
+Reported-by: Red Hat Product Security
+Bug: https://curl.se/docs/CVE-2021-22925.html
+
+Upstream-commit: 894f6ec730597eb243618d33cc84d71add8d6a8a
+Signed-off-by: Kamil Dudka <kdudka@redhat.com>
+---
+ lib/telnet.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/lib/telnet.c b/lib/telnet.c
+index fdd137f..567c22c 100644
+--- a/lib/telnet.c
++++ b/lib/telnet.c
+@@ -922,12 +922,17 @@ static void suboption(struct Curl_easy *data)
+         size_t tmplen = (strlen(v->data) + 1);
+         /* Add the variable only if it fits */
+         if(len + tmplen < (int)sizeof(temp)-6) {
+-          if(sscanf(v->data, "%127[^,],%127s", varname, varval) == 2) {
+-            msnprintf((char *)&temp[len], sizeof(temp) - len,
+-                      "%c%s%c%s", CURL_NEW_ENV_VAR, varname,
+-                      CURL_NEW_ENV_VALUE, varval);
+-            len += tmplen;
+-          }
++          int rv;
++          char sep[2] = "";
++          varval[0] = 0;
++          rv = sscanf(v->data, "%127[^,]%1[,]%127s", varname, sep, varval);
++          if(rv == 1)
++            len += msnprintf((char *)&temp[len], sizeof(temp) - len,
++                             "%c%s", CURL_NEW_ENV_VAR, varname);
++          else if(rv >= 2)
++            len += msnprintf((char *)&temp[len], sizeof(temp) - len,
++                             "%c%s%c%s", CURL_NEW_ENV_VAR, varname,
++                             CURL_NEW_ENV_VALUE, varval);
+         }
+       }
+       msnprintf((char *)&temp[len], sizeof(temp) - len,
+-- 
+2.31.1
+
diff --git a/curl.spec b/curl.spec
index c058467..5492608 100644
--- a/curl.spec
+++ b/curl.spec
@@ -20,6 +20,9 @@ Patch4:   0004-curl-7.76.1-ldaps-segv.patch
 # fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
 Patch5:   0005-curl-7.76.1-CVE-2021-22924.patch
 
+# fix TELNET stack contents disclosure again (CVE-2021-22925)
+Patch6:   0006-curl-7.76.1-CVE-2021-22925.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -199,6 +202,7 @@ be installed.
 %patch3 -p1
 %patch4 -p1
 %patch5 -p1
+%patch6 -p1
 
 # Fedora patches
 %patch101 -p1
@@ -379,6 +383,7 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
 
 %changelog
 * Wed Jul 21 2021 Kamil Dudka <kdudka@redhat.com> - 7.76.1-7
+- fix TELNET stack contents disclosure again (CVE-2021-22925)
 - fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
 
 * Tue Jun 15 2021 Mohan Boddu <mboddu@redhat.com> - 7.76.1-6