diff --git a/xstream-distribution-1.4.17-src.zip b/xstream-distribution-1.4.18-src.zip
similarity index 77%
rename from xstream-distribution-1.4.17-src.zip
rename to xstream-distribution-1.4.18-src.zip
index 67af93c..b7392ba 100644
Binary files a/xstream-distribution-1.4.17-src.zip and b/xstream-distribution-1.4.18-src.zip differ
diff --git a/xstream.spec b/xstream.spec
index 148bb3b..f7ba5d3 100644
--- a/xstream.spec
+++ b/xstream.spec
@@ -1,7 +1,7 @@
 %bcond_with jp_minimal
 Name:                xstream
-Version:             1.4.17
-Release:             2
+Version:             1.4.18
+Release:             1
 Summary:             Java XML serialization library
 License:             BSD
 URL:                 http://x-stream.github.io/
@@ -132,6 +132,9 @@ mvn install --settings ./settings.xml -Dmaven.test.skip=true
 %license LICENSE.txt
 
 %changelog
+* Sat Sep 4 2021 houyingchao <houyingchao@huawei.com> - 1.4.18-1
+- Upgrade 1.4.18 to fix cves
+
 * Thu 22 Jul 2021 sunguoshuai <sunguoshuai@huawei.com> - 1.4.17-2
 - Change setting.xml to huaweicloud