diff --git a/.gitignore b/.gitignore
index 7d34429..80af151 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,4 @@
 /libgit2-0.25.1.tar.gz
 /libgit2-0.26.0.tar.gz
 /libgit2-0.26.3.tar.gz
+/libgit2-0.26.4.tar.gz
diff --git a/libgit2.spec b/libgit2.spec
index d19dc0f..69ea3e3 100644
--- a/libgit2.spec
+++ b/libgit2.spec
@@ -1,5 +1,5 @@
 Name:           libgit2
-Version:        0.26.3
+Version:        0.26.4
 Release:        1%{?dist}
 Summary:        C implementation of the Git core methods as a library with a solid API
 License:        GPLv2 with exceptions
@@ -74,6 +74,9 @@ popd
 %{_includedir}/git2/
 
 %changelog
+* Mon Jun 25 2018 Pete Walter <pwalter@fedoraproject.org> - 0.26.4-1
+- Update to 0.26.4 (CVE-2018-11235)
+
 * Mon Mar 12 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 0.26.3-1
 - Update to 0.26.3
 
diff --git a/sources b/sources
index 87f0194..2dd8b81 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (libgit2-0.26.3.tar.gz) = abcd3a904bed05c1f200be2ffbc2c44cebd1b548459ee834d5635c5eaf7bcd551a4993bcc1cb9fbeae9ea990c5ebc07655007ff4e623fa7c697f326c0ce12c3e
+SHA512 (libgit2-0.26.4.tar.gz) = c65a0ef8e7ef2dc60d07bced36b8cfd26ce9c40f99978058fc67b30e5bbda8d6b15e26aec7b1277bb277123685e763d106bab175540fceb449bb5b50f776473a