diff --git a/libtasn1-4.20-cve-2025-13151-stack-buffer-overflow.patch b/libtasn1-4.20-cve-2025-13151-stack-buffer-overflow.patch
new file mode 100644
index 0000000..1c3440d
--- /dev/null
+++ b/libtasn1-4.20-cve-2025-13151-stack-buffer-overflow.patch
@@ -0,0 +1,26 @@
+From e50542a7c2f14115c0a6e9eb6068889c249b6b03 Mon Sep 17 00:00:00 2001
+From: Vijay Sarvepalli <vssarvepalli@cert.org>
+Date: Mon, 22 Dec 2025 12:24:27 -0500
+Subject: [PATCH] Fix for CVE-2025-13151 Buffer overflow
+
+Signed-off-by: Simon Josefsson <simon@josefsson.org>
+---
+ lib/decoding.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/decoding.c b/lib/decoding.c
+index 1e0fcb3..abcb49f 100644
+--- a/lib/decoding.c
++++ b/lib/decoding.c
+@@ -1983,7 +1983,7 @@ int
+ asn1_expand_octet_string (asn1_node_const definitions, asn1_node *element,
+ 			  const char *octetName, const char *objectName)
+ {
+-  char name[2 * ASN1_MAX_NAME_SIZE + 1], value[ASN1_MAX_NAME_SIZE];
++  char name[2 * ASN1_MAX_NAME_SIZE + 2], value[ASN1_MAX_NAME_SIZE];
+   int retCode = ASN1_SUCCESS, result;
+   int len, len2, len3;
+   asn1_node_const p2;
+-- 
+2.54.0
+
diff --git a/libtasn1.spec b/libtasn1.spec
index 1b72f16..b98178e 100644
--- a/libtasn1.spec
+++ b/libtasn1.spec
@@ -1,8 +1,8 @@
 ## START: Set by rpmautospec
-## (rpmautospec version 0.6.5)
+## (rpmautospec version 0.8.4)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 1;
+    release_number = 5;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -22,12 +22,16 @@ Source1:	http://ftp.gnu.org/gnu/libtasn1/%name-%version.tar.gz.sig
 #Source2:	gpgkey-99415CE1905D0E55A9F88026860B7FBB32F8119D.gpg
 Source2:        gpgkey-B1D2BD1375BECB784CF4F8C4D73CF638C53C06BE.gpg
 Patch1:		libtasn1-3.4-rpath.patch
+Patch2:		libtasn1-4.20-cve-2025-13151-stack-buffer-overflow.patch
 
 BuildRequires:	gnupg2
+BuildRequires:	git-core
 BuildRequires:	gcc
 BuildRequires:	bison, pkgconfig, help2man
 BuildRequires:	autoconf, automake, libtool
+%ifarch %{valgrind_arches}
 BuildRequires:	valgrind-devel
+%endif
 BuildRequires:  make
 BuildRequires:  gtk-doc
 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
@@ -64,10 +68,9 @@ data.
 
 
 %prep
-gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
-%setup -q
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 
-%patch1 -p1 -b .rpath
+%autosetup -p1 -S git
 
 %build
 autoreconf -v -f --install
@@ -106,6 +109,18 @@ make check
 
 %changelog
 ## START: Generated by rpmautospec
+* Wed May 27 2026 Daiki Ueno <dueno@redhat.com> - 4.20.0-5
+- Fix for CVE-2025-13151 stack buffer overflow
+
+* Wed May 27 2026 Daiki Ueno <dueno@redhat.com> - 4.20.0-4
+- Switch to autosetup
+
+* Fri Jun 27 2025 Alexander Sosedkin <asosedkin@redhat.com> - 4.20.0-3
+- plans/ci: modify plan names
+
+* Sat Apr 19 2025 David Abdurachmanov <davidlt@rivosinc.com> - 4.20.0-2
+- Properly check valgrind arches
+
 * Wed Feb 12 2025 Alexander Sosedkin <asosedkin@redhat.com> - 4.20.0-1
 - Update to 4.20.0 to fix CVE-2024-12133