Backport of r77429. Not merged/blocked as svnmerge.py is not liking me right now.
diff --git a/Misc/NEWS b/Misc/NEWS
index e115695..86ffa55 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -122,6 +122,8 @@
 Extension Modules
 -----------------
 
+- Fix a segfault that could be triggered by expat with specially formed input.
+
 - Issue #6561: '\d' in a regex now matches only characters with
   Unicode category 'Nd' (Number, Decimal Digit).  Previously it also
   matched characters with category 'No'.