1 files changed, 6 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index 4c392a445e..07e9eac52d 100644
--- a/NEWS
+++ b/NEWS
@@ -170,6 +170,12 @@ Security related changes:
   function could result in a memory leak and potential access of
   uninitialized memory.  Reported by Qualys.
 
+  CVE-2021-3999: Passing a buffer of size exactly 1 byte to the getcwd
+  function may result in an off-by-one buffer underflow and overflow
+  when the current working directory is longer than PATH_MAX and also
+  corresponds to the / directory through an unprivileged mount
+  namespace.  Reported by Qualys.
+
 The following bugs are resolved with this release:
 
   [The release manager will add the list generated by