diff --git a/zlib-1.2.11-covscan-issues-rhel9.patch b/zlib-1.2.11-covscan-issues-rhel9.patch
new file mode 100644
index 0000000..d692589
--- /dev/null
+++ b/zlib-1.2.11-covscan-issues-rhel9.patch
@@ -0,0 +1,65 @@
+From 1e56dd1e7285d3026092ba794078edb290b4c1b1 Mon Sep 17 00:00:00 2001
+From: Ondrej Dubaj <odubaj@redhat.com>
+Date: Mon, 15 Mar 2021 13:06:35 +0100
+Subject: [PATCH] fixed isues found by covscan
+
+---
+ contrib/minizip/mztools.c | 8 ++++++++
+ contrib/minizip/zip.c     | 4 ++--
+ deflate.c                 | 5 +++--
+ 3 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/contrib/minizip/mztools.c b/contrib/minizip/mztools.c
+index 96891c2..1197928 100644
+--- a/contrib/minizip/mztools.c
++++ b/contrib/minizip/mztools.c
+@@ -286,6 +286,14 @@ uLong* bytesRecovered;
+     }
+   } else {
+     err = Z_STREAM_ERROR;
++    if(fpZip != NULL)
++      fclose(fpZip);
++
++    if(fpOut != NULL)
++      fclose(fpOut);
++
++    if(fpOutCD != NULL)
++      fclose(fpOutCD);
+   }
+   return err;
+ }
+diff --git a/contrib/minizip/zip.c b/contrib/minizip/zip.c
+index 44e88a9..a753c17 100644
+--- a/contrib/minizip/zip.c
++++ b/contrib/minizip/zip.c
+@@ -526,8 +526,8 @@ local ZPOS64_T zip64local_SearchCentralDir(const zlib_filefunc64_32_def* pzlib_f
+         break;
+       }
+ 
+-      if (uPosFound!=0)
+-        break;
++    if (uPosFound!=0)
++      break;
+   }
+   TRYFREE(buf);
+   return uPosFound;
+diff --git a/deflate.c b/deflate.c
+index 085abbe..3963e79 100644
+--- a/deflate.c
++++ b/deflate.c
+@@ -203,9 +203,10 @@ local const config configuration_table[10] = {
+  * Initialize the hash table (avoiding 64K overflow for 16 bit systems).
+  * prev[] will be initialized on the fly.
+  */
+-#define CLEAR_HASH(s) \
++#define CLEAR_HASH(s) do { \
+     s->head[s->hash_size-1] = NIL; \
+-    zmemzero((Bytef *)s->head, (unsigned)(s->hash_size-1)*sizeof(*s->head));
++    zmemzero((Bytef *)s->head, (unsigned)(s->hash_size-1)*sizeof(*s->head)); \
++} while (0)
+ 
+ /* ===========================================================================
+  * Slide the hash table when sliding the window down (could be avoided with 32
+-- 
+2.26.0
+
diff --git a/zlib.spec b/zlib.spec
index 08a7307..70a1622 100644
--- a/zlib.spec
+++ b/zlib.spec
@@ -2,7 +2,7 @@
 
 Name:    zlib
 Version: 1.2.11
-Release: 25%{?dist}
+Release: 26%{?dist}
 Summary: Compression and decompression library
 # /contrib/dotzlib/ have Boost license
 License: zlib and Boost
@@ -30,6 +30,9 @@ Patch12: zlib-1.2.11-permit-deflateParams-change.patch
 Patch13: zlib-1.2.11-IBM-DFLTCC-compression-level-switching-issues.patch
 # fixed inflateSyncPoint() bad return value on z15
 Patch14: zlib-1.2.11-inflateSyncPoint-return-value-fix.patch
+# fixed issues found by covscan for rhel-9
+# ref: https://github.com/madler/zlib/pull/554
+Patch15: zlib-1.2.11-covscan-issues-rhel9.patch
 
 BuildRequires: make
 BuildRequires: automake, autoconf, libtool
@@ -96,6 +99,7 @@ developing applications which use minizip.
 %patch12 -p1
 %patch13 -p1
 %patch14 -p1
+%patch15 -p1
 
 
 iconv -f iso-8859-2 -t utf-8 < ChangeLog > ChangeLog.tmp
@@ -177,6 +181,9 @@ find $RPM_BUILD_ROOT -name '*.la' -delete
 
 
 %changelog
+* Wed Mar 31 2021 Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-26
+- fixed covscan issues for rhel-9
+
 * Fri Feb 12 2021 Michal Schorm <mschorm@redhat.com> - 1.2.11-25
 - Remove ancient PPC64 hack
 - Remove aarch64 optimalizations (#1936823)