diff --git a/.gitignore b/.gitignore
index 6907d80..fec7e61 100644
--- a/.gitignore
+++ b/.gitignore
@@ -68,3 +68,5 @@ openvpn-2.1.2.tar.gz.asc
 /openvpn-2.5.1.tar.xz.asc
 /openvpn-2.5.2.tar.xz
 /openvpn-2.5.2.tar.xz.asc
+/openvpn-2.5.3.tar.xz
+/openvpn-2.5.3.tar.xz.asc
diff --git a/openvpn.spec b/openvpn.spec
index 8432d48..e773a1e 100644
--- a/openvpn.spec
+++ b/openvpn.spec
@@ -5,7 +5,7 @@
 %bcond_without tests_long
 
 Name:              openvpn
-Version:           2.5.2
+Version:           2.5.3
 Release:           1%{?dist}
 Summary:           A full-featured TLS VPN solution
 URL:               https://community.openvpn.net/
@@ -193,6 +193,10 @@ getent passwd openvpn &>/dev/null || \
 
 
 %changelog
+* Fri Jun 18 2021 David Sommerseth <davids@openvpn.net> - 2.5.3-1
+- Update to upstream OpenVPN 2.5.3
+- Fixes CVE-2021-3606
+
 * Wed Apr 21 2021 David Sommerseth <davids@openvpn.net> - 2.5.2-1
 - Update to upstream OpenVPN 2.5.2
 - Fixes CVE-2020-15078
diff --git a/sources b/sources
index 5a4d97e..f511a71 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (openvpn-2.5.2.tar.xz) = ae2cac00ae4b9e06e7e70b268ed47d36bbb45409650175e507d5bfa12b0a4f24bccc64f2494d1563f9269c8076d0f753a492f01ea33ce376ba00b7cdcb5c7bd0
-SHA512 (openvpn-2.5.2.tar.xz.asc) = 49a5f1828d8621e8d71665435efbc5fb55baee9db44c4d8768159667fdddf2ce30c964a11aa6fb28fee37adc34ff5ca8c9eb4c0669b4d847a9ffd0f8aab871b4
+SHA512 (openvpn-2.5.3.tar.xz) = bde61a12cef76c54a8d120e2bf3dfd04b9b76f28180bb8b9a496f27ad9cb545cf1137aa2751df5944e81356899b3824f06b8cfd777496212768e2b9aecf7bf6d
+SHA512 (openvpn-2.5.3.tar.xz.asc) = c204fb06443e5962dec730e6c73686e74df498470a86603e3d727434e38c3bfa243f0ec3c417ad7056c0092f8b80d567ca388058b8f542c5aaa3f33d399e9658