diff --git a/package/network/services/dnsmasq/patches/0015-fix-build-with-libnettle-3.5.patch b/package/network/services/dnsmasq/patches/0015-fix-build-with-libnettle-3.5.patch
new file mode 100644
index 0000000000..901585aa82
--- /dev/null
+++ b/package/network/services/dnsmasq/patches/0015-fix-build-with-libnettle-3.5.patch
@@ -0,0 +1,33 @@
+diff --git a/src/crypto.c b/src/crypto.c
+index ebb871e..94d0332 100644
+--- a/src/crypto.c
++++ b/src/crypto.c
+@@ -275,6 +275,10 @@ static int dnsmasq_ecdsa_verify(struct blockdata *key_data, unsigned int key_len
+   static struct ecc_point *key_256 = NULL, *key_384 = NULL;
+   static mpz_t x, y;
+   static struct dsa_signature *sig_struct;
++#if NETTLE_VERSION_MAJOR == 3 && NETTLE_VERSION_MINOR < 4
++#define nettle_get_secp_256r1() (&nettle_secp_256r1)
++#define nettle_get_secp_384r1() (&nettle_secp_384r1)
++#endif
+   
+   if (!sig_struct)
+     {
+@@ -294,7 +298,7 @@ static int dnsmasq_ecdsa_verify(struct blockdata *key_data, unsigned int key_len
+ 	  if (!(key_256 = whine_malloc(sizeof(struct ecc_point))))
+ 	    return 0;
+ 	  
+-	  nettle_ecc_point_init(key_256, &nettle_secp_256r1);
++	  nettle_ecc_point_init(key_256, nettle_get_secp_256r1());
+ 	}
+       
+       key = key_256;
+@@ -307,7 +311,7 @@ static int dnsmasq_ecdsa_verify(struct blockdata *key_data, unsigned int key_len
+ 	  if (!(key_384 = whine_malloc(sizeof(struct ecc_point))))
+ 	    return 0;
+ 	  
+-	  nettle_ecc_point_init(key_384, &nettle_secp_384r1);
++	  nettle_ecc_point_init(key_384, nettle_get_secp_256r1());
+ 	}
+       
+       key = key_384;