diff --git a/nghttp2-1.40.0.tar.xz b/nghttp2-1.40.0.tar.xz
deleted file mode 100644
index 9612930..0000000
--- a/nghttp2-1.40.0.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:09fc43d428ff237138733c737b29fb1a7e49d49de06d2edbed3bc4cdcee69073
-size 1637004
diff --git a/nghttp2-1.41.0.tar.xz b/nghttp2-1.41.0.tar.xz
new file mode 100644
index 0000000..dd6e110
--- /dev/null
+++ b/nghttp2-1.41.0.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:abc25b8dc601f5b3fefe084ce50fcbdc63e3385621bee0cbfa7b57f9ec3e67c2
+size 1640712
diff --git a/nghttp2.changes b/nghttp2.changes
index 7d7ffc9..3403513 100644
--- a/nghttp2.changes
+++ b/nghttp2.changes
@@ -1,3 +1,18 @@
+-------------------------------------------------------------------
+Wed Jun  3 11:45:25 UTC 2020 - Paolo Stivanin <info@paolostivanin.com>
+
+- Update to 1.41.0
+  * Fix CVE-2020-11080
+  * lib: Implement max settings option (Patch from James M Snell)
+  * lib: Earlier check for settings flood (Patch from James M Snell)
+  * lib: Fix receiving stream data stall (GH-1444)
+  * build: cmake: Make hard-coded static lib suffix optional (Patch from Viktor Szakats) (GH-1418)
+  * third-party: Bump llhttp to 2.0.4 (GH-1442)
+  * nghttpx: Add PROXY-protocol v2 support (GH-1452)
+  * nghttpx: Fix get_x509_serial for long serial numbers (Patch from Jacky Tian) (GH-1455)
+  * h2load: Allow port in --connect-to
+  * h2load: add --connect-to option (Patch from Lucas Pardue) (GH-1426)
+
 -------------------------------------------------------------------
 Tue Jan 14 18:01:52 UTC 2020 - Michał Rostecki <mrostecki@opensuse.org>
 
diff --git a/nghttp2.spec b/nghttp2.spec
index 9d7ea04..47c547c 100644
--- a/nghttp2.spec
+++ b/nghttp2.spec
@@ -29,7 +29,7 @@
 %bcond_with python
 %endif
 Name:           nghttp2%{psuffix}
-Version:        1.40.0
+Version:        1.41.0
 Release:        0
 Summary:        Implementation of Hypertext Transfer Protocol version 2 in C
 License:        MIT