1 files changed, 5 insertions, 0 deletions
diff --git a/Misc/NEWS b/Misc/NEWS
index cee7db8a53..ad287373f6 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -19,6 +19,11 @@ Core and Builtins
 Library
 -------
 
+- Issue #23529: Limit the size of decompressed data when reading from
+  GzipFile, BZ2File or LZMAFile.  This defeats denial of service attacks
+  using compressed bombs (i.e. compressed payloads which decompress to a huge
+  size).  Patch by Martin Panter and Nikolaus Rath.
+
 - Issue #21859: Added Python implementation of io.FileIO.
 
 - Issue #23865: close() methods in multiple modules now are idempotent and more