diff --git a/netpbm.changes b/netpbm.changes
index ce8f5e7..fdb9250 100644
--- a/netpbm.changes
+++ b/netpbm.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Fri Jul 12 10:35:11 UTC 2024 - pgajdos@suse.com
+
+- fix CVE-2024-38526 [bsc#1227693] Polyfill Supplay Chain Attack
+
 -------------------------------------------------------------------
 Fri Feb  2 14:11:02 UTC 2024 - pgajdos@suse.com
 
diff --git a/netpbm.spec b/netpbm.spec
index 1450a9c..613b550 100644
--- a/netpbm.spec
+++ b/netpbm.spec
@@ -117,9 +117,12 @@ export LDFLAGS="$LDFLAGS -fsanitize=undefined"
 %endif
 make %{?_smp_mflags} CFLAGS="$CFLAGS"
 rm doc/INSTALL
-#
-# convert html to man pages
+# DOC
 cd netpbm.sourceforge.net/doc
+# CVE-2024-38526
+# notified upstream on 2024-07-12
+sed -i 's/polyfill.io/cdnjs.cloudflare.com/' pamhomography.html
+# convert html to man pages
  ../../buildtools/makeman *.html
 for i in 1 3 5 ; do
   mkdir -p ../../man/man${i}