diff --git a/0017-fix-CVE-2026-37457.patch b/0017-fix-CVE-2026-37457.patch
new file mode 100644
index 0000000..09b25a8
--- /dev/null
+++ b/0017-fix-CVE-2026-37457.patch
@@ -0,0 +1,48 @@
+From c27757965a55e181b3f63239249bbd6ce249a082 Mon Sep 17 00:00:00 2001
+From: Jafar Al-Gharaibeh <jafar@atcorp.com>
+Date: Mon, 9 Mar 2026 14:36:22 -0500
+Subject: [PATCH] bgpd: fix off-by-one error in FlowSpec operator array bounds
+ check
+
+Change loop > BGP_PBR_MATCH_VAL_MAX to loop >= BGP_PBR_MATCH_VAL_MAX
+in bgp_flowspec_op_decode() and bgp_flowspec_bitmask_decode() to
+prevent writing one element past the end of the mval[] array when
+more than 5 chained operators are present in a FlowSpec component.
+
+Reported-by: Jiahao Lei
+Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>
+---
+ bgpd/bgp_flowspec_util.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/bgpd/bgp_flowspec_util.c b/bgpd/bgp_flowspec_util.c
+index 90e9236..4dd5034 100644
+--- a/bgpd/bgp_flowspec_util.c
++++ b/bgpd/bgp_flowspec_util.c
+@@ -266,8 +266,10 @@ int bgp_flowspec_op_decode(enum bgp_flowspec_util_nlri_t type,
+ 
+ 	*error = 0;
+ 	do {
+-		if (loop > BGP_PBR_MATCH_VAL_MAX)
++		if (loop >= BGP_PBR_MATCH_VAL_MAX) {
+ 			*error = -2;
++			return offset;
++		}
+ 		hex2bin(&nlri_ptr[offset], op);
+ 		offset++;
+ 		len = 2*op[2]+op[3];
+@@ -370,8 +372,10 @@ int bgp_flowspec_bitmask_decode(enum bgp_flowspec_util_nlri_t type,
+ 
+ 	*error = 0;
+ 	do {
+-		if (loop > BGP_PBR_MATCH_VAL_MAX)
++		if (loop >= BGP_PBR_MATCH_VAL_MAX) {
+ 			*error = -2;
++			return offset;
++		}
+ 		hex2bin(&nlri_ptr[offset], op);
+ 		/* if first element, AND bit can not be set */
+ 		if (op[1] == 1 && loop == 0)
+-- 
+2.52.0
+
diff --git a/frr.spec b/frr.spec
index e599e68..1b41ff5 100644
--- a/frr.spec
+++ b/frr.spec
@@ -7,7 +7,7 @@
 
 Name: frr
 Version: 8.5.3
-Release: 12%{?checkout}%{?dist}
+Release: 13%{?checkout}%{?dist}
 Summary: Routing daemon
 License: GPLv2+
 URL: http://www.frrouting.org
@@ -80,6 +80,7 @@ Patch0013: 0013-bfd-bgp-recovery.patch
 Patch0014: 0014-isisd-fuzz-test.patch
 Patch0015: 0015-ipv6-wrong-hash.patch
 Patch0016: 0016-dont-ignore-kernel-route.patch
+Patch0017: 0017-fix-CVE-2026-37457.patch
 
 %description
 FRRouting is free software that manages TCP/IP based routing protocols. It takes
@@ -287,6 +288,9 @@ make check PYTHON=%{__python3}
 %endif
 
 %changelog
+* Thu May 21 2026 Michal Ruprich <mruprich@redhat.com> - 8.5.3-13
+- Resolves: RHEL-174677 - denial of service via crafted FlowSpec component
+
 * Fri Jan 16 2026 Michal Ruprich <mruprich@redhat.com> - 8.5.3-12
 - Resolves: RHEL-137180 - Files under /var are not properly created in image-mode