diff --git a/download b/download
index 56a807382861d91123494c185358a5d15217f1a5..c1dfadea894db54acc7ce5309085f3fd9f97a026 100644
--- a/download
+++ b/download
@@ -1,2 +1 @@
-fb02aac10a17256e9e19547bf6e53eff  openjdk-jdk17u-jdk-17.0.5+8.tar.xz
 5d441d6217cc75372ca5a0943997cb24  tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
index 2fc1c6fcce7907ff584b6f1abf65159600324943..19f583ee7dee596e12ec9f8a9a9d91ddcfa81931 100644
--- a/java-17-openjdk.spec
+++ b/java-17-openjdk.spec
@@ -13,7 +13,7 @@
 # Only produce a release build on x86_64:
 # $ fedpkg mockbuild --without slowdebug --without fastdebug
 
-%global anolis_release      4
+%global anolis_release      1
 # Enable fastdebug builds by default on relevant arches.
 %bcond_without fastdebug
 # Enable slowdebug builds by default on relevant arches.
@@ -268,7 +268,7 @@
 # New Version-String scheme-style defines
 %global featurever 17
 %global interimver 0
-%global updatever 5
+%global updatever 9
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
@@ -293,7 +293,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        8
+%global buildver        9
 %global rpmrelease      3
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@@ -1628,11 +1628,11 @@ The %{origin_nice} %{featurever} API documentation compressed in a single archiv
 echo "Preparing %{oj_vendor_version}"
 
 # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
-%if 0%{?stapinstall:1}
-  echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{stapinstall}"
-%else
-  %{error:Unrecognised architecture %{_target_cpu}}
-%endif
+#%if 0%{?stapinstall:1}
+#  echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{stapinstall}"
+#%else
+#  %{error:Unrecognised architecture %{_target_cpu}}
+#%endif
 
 if [ %{include_normal_build} -eq 0 -o  %{include_normal_build} -eq 1 ] ; then
   echo "include_normal_build is %{include_normal_build}"
@@ -2493,6 +2493,9 @@ require "copy_jdk_configs.lua"
 %endif
 
 %changelog
+* Thu July 04 2024 Kaiqiang Wang <wangkaiqiang@inspur.com> - 1:17.0.9.9-1
+- fix CVE-2023-22025
+
 * Thu Nov 09 2023 Leslie Zhai <zhaixiang@loongson.cn> - 1:17.0.5.0.8-4
 - Disable gdb
 
diff --git a/openjdk-17.0.9+9.tar.xz b/openjdk-17.0.9+9.tar.xz
new file mode 100644
index 0000000000000000000000000000000000000000..842e13d6626e9223dd603f541dac7173efdb56ad
Binary files /dev/null and b/openjdk-17.0.9+9.tar.xz differ