diff --git a/backport-CVE-2024-47081.patch b/backport-CVE-2024-47081.patch
new file mode 100644
index 0000000000000000000000000000000000000000..c2beaf3066d2bedeea6824b0d3a276c498eaf418
--- /dev/null
+++ b/backport-CVE-2024-47081.patch
@@ -0,0 +1,35 @@
+From 96ba401c1296ab1dda74a2365ef36d88f7d144ef Mon Sep 17 00:00:00 2001
+From: Nate Prewitt <nate.prewitt@gmail.com>
+Date: Wed, 25 Sep 2024 08:03:20 -0700
+Subject: [PATCH] Only use hostname to do netrc lookup instead of netloc
+
+Conflict:NA
+Reference:https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef
+
+---
+ src/pip/_vendor/requests/utils.py | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/src/pip/_vendor/requests/utils.py b/src/pip/_vendor/requests/utils.py
+index fcb9966..abffd5b 100644
+--- a/src/pip/_vendor/requests/utils.py
++++ b/src/pip/_vendor/requests/utils.py
+@@ -204,13 +204,7 @@ def get_netrc_auth(url, raise_errors=False):
+             return
+ 
+         ri = urlparse(url)
+-
+-        # Strip port numbers from netloc. This weird `if...encode`` dance is
+-        # used for Python 3.2, which doesn't support unicode literals.
+-        splitstr = b":"
+-        if isinstance(url, str):
+-            splitstr = splitstr.decode("ascii")
+-        host = ri.netloc.split(splitstr)[0]
++        host = ri.hostname
+ 
+         try:
+             _netrc = netrc(netrc_path).authenticators(host)
+-- 
+2.33.0
+
+
diff --git a/python-pip.spec b/python-pip.spec
index c979ed812063fc851a754ec576349fac77d3cc1b..0f8cb13db8d9cf2f5e94309f106afa0949454a29 100644
--- a/python-pip.spec
+++ b/python-pip.spec
@@ -1,4 +1,4 @@
-%define anolis_release 3
+%define anolis_release 4
 
 %bcond_with tests
 %bcond_with doc
@@ -30,7 +30,8 @@ Patch0003:      0003-nowarn-pip._internal.main.patch
 Patch0004:      0004-no-version-warning.patch
 # https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857#diff-2fe80b3f580c0daa9f6a97de561c7fcd92fde02afdfaecdc210b6563817e69bb
 Patch1000:      1000-fix-CVE-2025-50181.patch
-
+# https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef
+Patch1001:	backport-CVE-2024-47081.patch
 %global bundled() %{expand:
 Provides: bundled(python%{1}dist(cachecontrol)) = 0.13.1
 Provides: bundled(python%{1}dist(certifi)) = 2023.7.22
@@ -233,6 +234,9 @@ pytest_k='not completion'
 %endif
 
 %changelog
+* Tue Oct 14 2025 wenxin <wx02272781@alibaba-inc.com> - 23.3.1-4
+- Add patch to fix CVE-2024-47081 
+
 * Thu Sep 25 2025 mgb01105731 <mgb01105731@alibaba-inc.com> - 23.3.1-3
 - Add patch to fix CVE-2025-50181