1 files changed, 4 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index a9ef33b6..d910c19d 100644
--- a/NEWS
+++ b/NEWS
@@ -88,6 +88,10 @@ fetchmail-6.4.0 (not yet released):
   in favour of another configuration option that makes the insecurity in using
   this option clearer.
 
+## SECURITY FIXES
+* Fetchmail prevents buffer overruns in GSSAPI authentication with user names
+  beyond c. 6000 characters in length. Reported by Greg Hudson.
+
 ## CHANGES
 * fetchmail 6.3.X is unsupported.
 * fetchmail now requires OpenSSL v1.0.2 or newer.