diff --git a/.gitignore b/.gitignore
index 3eabb7a..4aa511b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -155,3 +155,5 @@ samba-3.6.0pre1.tar.gz
 /samba-4.9.7.tar.asc
 /samba-4.9.8.tar.xz
 /samba-4.9.8.tar.asc
+/samba-4.9.9.tar.xz
+/samba-4.9.9.tar.asc
diff --git a/samba.spec b/samba.spec
index c6cdfbc..7d960d8 100644
--- a/samba.spec
+++ b/samba.spec
@@ -6,9 +6,9 @@
 # ctdb is enabled by default, you can disable it with: --without clustering
 %bcond_without clustering
 
-%define main_release 1
+%define main_release 0
 
-%define samba_version 4.9.8
+%define samba_version 4.9.9
 %define talloc_version 2.1.14
 %define tdb_version 1.3.16
 %define tevent_version 0.9.37
@@ -3850,6 +3850,10 @@ fi
 %endif # with_clustering_support
 
 %changelog
+* Wed Jun 19 2019 Guenther Deschner <gdeschner@redhat.com> - 4.9.9-0
+- Update to Samba 4.9.9
+- resolves: #1711816, #1721872 - Security fixes for CVE-2019-12435
+
 * Tue May 28 2019 Guenther Deschner <gdeschner@redhat.com> - 4.9.8-1
 - Add missing ctdb directories
 - resolves: #1656777
diff --git a/sources b/sources
index d2dc0de..6ab5702 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.9.8.tar.xz) = 42fb5b59c1d07cdfb2c3774ac727387fc90471aa6d1f50ff2e9cb5bd10186da69cb1f0be918a9081f5ef3307448555826643c0d3ef03b4cc3658e0cc18de7981
-SHA512 (samba-4.9.8.tar.asc) = 3112e6537f7613c76e6cf4b1cb3945689b37dbb68bc2d8a8523304b026d320174d3b33db743d9dbae320d155405aeb9da3523d81204d1293bc6eeeca6e2c0969
+SHA512 (samba-4.9.9.tar.xz) = f4cc869b543869e2065d4cdc1ae3e276e491418460b532b8e751e903841bfcc65967f823a2b1483170a79492a28237862b8154d2e4e5d3c779b77633cfb30a8d
+SHA512 (samba-4.9.9.tar.asc) = 9f9586dad36b32fff57328d23a53fa1fae3454e687b3d8ca694e31ac41610f60407cc1778669ac458dcf0a1dd95356fdc68ee5669df7304f380b966e5f626a1a