diff --git a/package/libxmlsec1/Config.in b/package/libxmlsec1/Config.in
index 4a686853ae..782e6ced7c 100644
--- a/package/libxmlsec1/Config.in
+++ b/package/libxmlsec1/Config.in
@@ -1,5 +1,7 @@
 config BR2_PACKAGE_LIBXMLSEC1
 	bool "libxmlsec1"
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_7 #-Wformat-overflow
+	depends on BR2_TOOLCHAIN_HAS_ATOMIC
 	select BR2_PACKAGE_OPENSSL
 	select BR2_PACKAGE_LIBXML2
 	help
@@ -10,3 +12,6 @@ config BR2_PACKAGE_LIBXMLSEC1
 
 	  https://www.aleksey.com/xmlsec/
 	  https://github.com/lsh123/xmlsec
+
+comment "libxmlsec1 needs a toolchain w/ gcc >= 7"
+	depends on  !BR2_TOOLCHAIN_GCC_AT_LEAST_7 || !BR2_TOOLCHAIN_HAS_ATOMIC
diff --git a/package/libxmlsec1/libxmlsec1.hash b/package/libxmlsec1/libxmlsec1.hash
index 9e0e67e732..d9cb16a1c2 100644
--- a/package/libxmlsec1/libxmlsec1.hash
+++ b/package/libxmlsec1/libxmlsec1.hash
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  a631c8cd7a6b86e6adb9f5b935d45a9cf9768b3cb090d461e8eb9d043cf9b62f  xmlsec1-1.3.9.tar.gz
-sha256  d5e9388534256360c6a009d4f19ab2b8d6ec0aa7ff32a51e22d899ed7beb5c48  Copyright
+sha256  24045199af12d93fe5fdbbbf7e386e823e4842071e9432e2b90ac108b889a923  xmlsec1-1.3.12.tar.gz
+sha256  a6d217151f3d423e06639c075bad8e442ea1936828d3a660105122ef78ecd96d  Copyright
diff --git a/package/libxmlsec1/libxmlsec1.mk b/package/libxmlsec1/libxmlsec1.mk
index 29222bc16f..88f0ae9fd9 100644
--- a/package/libxmlsec1/libxmlsec1.mk
+++ b/package/libxmlsec1/libxmlsec1.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBXMLSEC1_VERSION = 1.3.9
+LIBXMLSEC1_VERSION = 1.3.12
 LIBXMLSEC1_SOURCE = xmlsec1-$(LIBXMLSEC1_VERSION).tar.gz
 LIBXMLSEC1_SITE = https://github.com/lsh123/xmlsec/releases/download/$(LIBXMLSEC1_VERSION)
 LIBXMLSEC1_LICENSE = MIT
@@ -22,6 +22,14 @@ LIBXMLSEC1_CONF_OPTS = \
 	--without-nss \
 	--disable-des
 
+# xmlsec_unit_tests needs xmlDebugDumpDocument() from libxml2 which is not
+# present in buildroot because libxml2 is build with -without-debug
+define LIBXMLSEC1_DISABLE_UNIT_TESTS
+	$(SED) 's/noinst_PROGRAMS = xmlsec_unit_tests/noinst_PROGRAMS =/' \
+		$(@D)/apps/Makefile.am
+endef
+LIBXMLSEC1_POST_PATCH_HOOKS += LIBXMLSEC1_DISABLE_UNIT_TESTS
+
 HOST_LIBXMLSEC1_CONF_OPTS = \
 	--enable-crypto-dl=no \
 	--with-openssl \