diff --git a/net-snmp-5.9.4-oob-access.patch b/net-snmp-5.9.4-oob-access.patch
new file mode 100644
index 0000000..426f8a8
--- /dev/null
+++ b/net-snmp-5.9.4-oob-access.patch
@@ -0,0 +1,54 @@
+From b4e6f826d9ddcc2d72eac432746807e1234266db Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Sun, 2 Nov 2025 14:48:55 -0800
+Subject: [PATCH] snmptrapd: Fix out-of-bounds trapOid[] accesses
+
+Fixes: https://issues.oss-fuzz.com/issues/457106694
+Fixes: https://issues.oss-fuzz.com/issues/458668421
+Fixes: https://issues.oss-fuzz.com/issues/458876071
+---
+ apps/snmptrapd_handlers.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/apps/snmptrapd_handlers.c b/apps/snmptrapd_handlers.c
+index 6cd126f266..afd93ed0fb 100644
+--- a/apps/snmptrapd_handlers.c
++++ b/apps/snmptrapd_handlers.c
+@@ -1112,6 +1112,12 @@ snmp_input(int op, netsnmp_session *session,
+ 	     */
+             if (pdu->trap_type == SNMP_TRAP_ENTERPRISESPECIFIC) {
+                 trapOidLen = pdu->enterprise_length;
++                /*
++                 * Drop packets that would trigger an out-of-bounds trapOid[]
++                 * access.
++                 */
++                if (trapOidLen < 1 || trapOidLen > OID_LENGTH(trapOid) - 2)
++                    return 1;
+                 memcpy(trapOid, pdu->enterprise, sizeof(oid) * trapOidLen);
+                 if (trapOid[trapOidLen - 1] != 0) {
+                     trapOid[trapOidLen++] = 0;
+From 35d216b57ea2e9abf1cc42077bcf60a4bae0b29e Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Sat, 1 Nov 2025 13:47:37 -0700
+Subject: [PATCH] snmptrapd: Do not write outside the bounds of trapOid[]
+
+---
+ apps/snmptrapd_handlers.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/apps/snmptrapd_handlers.c b/apps/snmptrapd_handlers.c
+index 0b8038f5d1..6cd126f266 100644
+--- a/apps/snmptrapd_handlers.c
++++ b/apps/snmptrapd_handlers.c
+@@ -1155,8 +1155,8 @@ snmp_input(int op, netsnmp_session *session,
+ 		    return 1;		/* ??? */
+ 		}
+ 	    }
+-            memcpy(trapOid, vars->val.objid, vars->val_len);
+-            trapOidLen = vars->val_len /sizeof(oid);
++            trapOidLen = SNMP_MIN(sizeof(trapOid), vars->val_len) / sizeof(oid);
++            memcpy(trapOid, vars->val.objid, trapOidLen * sizeof(oid));
+             break;
+ 
+         default:
+
diff --git a/net-snmp.spec b/net-snmp.spec
index dcd6421..d8097e8 100644
--- a/net-snmp.spec
+++ b/net-snmp.spec
@@ -10,7 +10,7 @@
 Summary:    A collection of SNMP protocol tools and libraries
 Name:       net-snmp
 Version:    5.9.1
-Release:    19%{?dist}
+Release:    20%{?dist}
 Epoch:      1
 
 License:    BSD
@@ -64,6 +64,7 @@ Patch34:    net-snmp-5.9.4-revert-n-snmptrapd-log.patch
 Patch35:    net-snmp-5.8-callback-fix.patch
 Patch36:    net-snmp-5.9.1-create-user-usage.patch
 Patch37:    net-snmp-5.9-remove-assert.patch
+Patch38:    net-snmp-5.9.4-oob-access.patch
 
 # Modern RPM API means at least EL6
 Patch101:   net-snmp-5.8-modern-rpm-api.patch
@@ -253,6 +254,7 @@ cp %{SOURCE10} .
 %patch35 -p1 -b .callback-fix
 %patch36 -p1 -b .create-user-usage
 %patch37 -p1 -b .remove-assert
+%patch38 -p1 -b .oob-access
 
 %patch101 -p1 -b .modern-rpm-api
 %patch102 -p1
@@ -522,6 +524,9 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test
 %{_libdir}/libnetsnmptrapd*.so.%{soname}*
 
 %changelog
+* Tue Jan 13 2026 Josef Ridky <jridky@redhat.com> - 1:5.9.1-20
+- fix out of bound access issue (RHEL-137511)
+
 * Tue Nov 04 2025 Josef Ridky <jridky@redhat.com> - 1:5.9.1-19
 - remove wrong assert (RHEL-122095)