diff --git a/package/libspdm/0002-Fix-security-vulnerability-in-GET_CSR-parsing-code.patch b/package/libspdm/0002-Fix-security-vulnerability-in-GET_CSR-parsing-code.patch
new file mode 100644
index 0000000000..6d10f33564
--- /dev/null
+++ b/package/libspdm/0002-Fix-security-vulnerability-in-GET_CSR-parsing-code.patch
@@ -0,0 +1,65 @@
+From 704bc9916ccd8c034f912f13b75fd890a19eb3f3 Mon Sep 17 00:00:00 2001
+From: Steven Bellock <sbellock@nvidia.com>
+Date: Tue, 27 Jan 2026 12:02:37 -0800
+Subject: [PATCH] Fix security vulnerability in GET_CSR parsing code
+
+Signed-off-by: Steven Bellock <sbellock@nvidia.com>
+Co-Authored-By: Nicholas Carlini <nicholas@carlini.com>
+
+Fixes: https://github.com/DMTF/libspdm/security/advisories/GHSA-j54w-759w-xj3m
+Upstream: https://github.com/DMTF/libspdm/commit/704bc9916ccd8c034f912f13b75fd890a19eb3f3
+Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
+---
+ os_stub/cryptlib_mbedtls/pk/x509.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/os_stub/cryptlib_mbedtls/pk/x509.c b/os_stub/cryptlib_mbedtls/pk/x509.c
+index 65eff62bfd5..1b5d60d4f92 100644
+--- a/os_stub/cryptlib_mbedtls/pk/x509.c
++++ b/os_stub/cryptlib_mbedtls/pk/x509.c
+@@ -1768,6 +1768,19 @@ static bool libspdm_convert_subject_to_string(uint8_t *ptr, size_t obj_len,
+                 (libspdm_consttime_is_mem_equal(cur->oid, internal_p, obj_len))) {
+                 /*Concat subject string*/
+ 
++                /*move to string*/
++                internal_p += obj_len;
++                ret = libspdm_asn1_get_tag(&internal_p, end, &obj_len, cur->default_tag);
++                if (!ret) {
++                    return false;
++                }
++
++                /*check total space needed: name + '=' + value + ',' + '\0'*/
++                if (buff_len < (int32_t)(cur->name_len + 1 + obj_len + 1 + 1)) {
++                    LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO,"the buffer is too small"));
++                    return false;
++                }
++
+                 /*for example: CN=*/
+                 libspdm_copy_mem(buffer, buff_len, cur->name, cur->name_len);
+                 buff_len = (int32_t)(buff_len - cur->name_len);
+@@ -1776,13 +1789,6 @@ static bool libspdm_convert_subject_to_string(uint8_t *ptr, size_t obj_len,
+                 buff_len--;
+                 buffer++;
+ 
+-                /*move to string*/
+-                internal_p += obj_len;
+-                ret = libspdm_asn1_get_tag(&internal_p, end, &obj_len, cur->default_tag);
+-                if (!ret) {
+-                    return false;
+-                }
+-
+                 /*for example: AU,*/
+                 libspdm_copy_mem(buffer, buff_len, internal_p, obj_len);
+                 buff_len = (int32_t)(buff_len - obj_len);
+@@ -1790,11 +1796,6 @@ static bool libspdm_convert_subject_to_string(uint8_t *ptr, size_t obj_len,
+                 *buffer = ',';
+                 buff_len--;
+                 buffer++;
+-
+-                if (buff_len < 0) {
+-                    LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO,"the buffer is too small"));
+-                    return false;
+-                }
+                 break;
+             }
+         }
diff --git a/package/libspdm/0003-Update-libspdm_rsp_measurement_extension_log.patch b/package/libspdm/0003-Update-libspdm_rsp_measurement_extension_log.patch
new file mode 100644
index 0000000000..c1a0f7eefc
--- /dev/null
+++ b/package/libspdm/0003-Update-libspdm_rsp_measurement_extension_log.patch
@@ -0,0 +1,29 @@
+From f55cf6d48ec69b4ac60a63903e9c6a2cb0fd155d Mon Sep 17 00:00:00 2001
+From: Steven Bellock <sbellock@nvidia.com>
+Date: Fri, 3 Apr 2026 11:00:07 -0700
+Subject: [PATCH] Update libspdm_rsp_measurement_extension_log.c
+
+Fix #3584 in 3.8.
+
+Signed-off-by: Steven Bellock <sbellock@nvidia.com>
+
+Fixes: https://github.com/DMTF/libspdm/security/advisories/GHSA-m4wc-xmvg-369f
+Upstream: https://github.com/DMTF/libspdm/commit/f55cf6d48ec69b4ac60a63903e9c6a2cb0fd155d
+Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
+---
+ .../spdm_responder_lib/libspdm_rsp_measurement_extension_log.c  | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/library/spdm_responder_lib/libspdm_rsp_measurement_extension_log.c b/library/spdm_responder_lib/libspdm_rsp_measurement_extension_log.c
+index 6dcb3a54bac..c5f2efa8c88 100644
+--- a/library/spdm_responder_lib/libspdm_rsp_measurement_extension_log.c
++++ b/library/spdm_responder_lib/libspdm_rsp_measurement_extension_log.c
+@@ -125,7 +125,7 @@ libspdm_return_t libspdm_get_response_measurement_extension_log(libspdm_context_
+                                                response_size, response);
+     }
+ 
+-    if ((uint64_t)(offset + length) > spdm_mel_len) {
++    if (((uint64_t)offset + length) > spdm_mel_len) {
+         length = (uint32_t)(spdm_mel_len - offset);
+     }
+     remainder_length = spdm_mel_len - (length + offset);