diff --git a/CVE-2019-9674.patch b/CVE-2019-9674.patch
new file mode 100644
index 0000000000000000000000000000000000000000..a482edc24ecbd1dd3890169bfbced174cea60c11
--- /dev/null
+++ b/CVE-2019-9674.patch
@@ -0,0 +1,89 @@
+From 96b55a2f5a66c0c5ede04428a2dd5e12b4d53c3d Mon Sep 17 00:00:00 2001
+From: JunWei Song <sungboss2004@gmail.com>
+Date: Wed, 11 Sep 2019 23:04:12 +0800
+Subject: [PATCH] bpo-36260: Add pitfalls to zipfile module documentation
+ (#13378)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+* bpo-36260: Add pitfalls to zipfile module documentation
+
+We saw vulnerability warning description (including zip bomb) in Doc/library/xml.rst file.
+This gave us the idea of documentation improvement.
+
+So, we moved a little bit forward :P
+And the doc patch can be found (pr).
+
+* fix trailing whitespace
+
+* 📜  🤖   Added by blurb_it.
+
+* Reformat text for consistency.
+
+---
+ Doc/library/zipfile.rst                       | 40 +++++++++++++++++++
+ .../2019-06-04-09-29-00.bpo-36260.WrGuc-.rst  |  1 +
+ 2 files changed, 41 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst
+
+diff --git a/Doc/library/zipfile.rst b/Doc/library/zipfile.rst
+index ba613b3..77a29fb 100644
+--- a/Doc/library/zipfile.rst
++++ b/Doc/library/zipfile.rst
+@@ -553,5 +553,45 @@ Command-line options
+
+    Test whether the zipfile is valid or not.
+
++Decompression pitfalls
++----------------------
++
++The extraction in zipfile module might fail due to some pitfalls listed below.
++
++From file itself
++~~~~~~~~~~~~~~~~
++
++Decompression may fail due to incorrect password / CRC checksum / ZIP format or
++unsupported compression method / decryption.
++
++File System limitations
++~~~~~~~~~~~~~~~~~~~~~~~
++
++Exceeding limitations on different file systems can cause decompression failed.
++Such as allowable characters in the directory entries, length of the file name,
++length of the pathname, size of a single file, and number of files, etc.
++
++Resources limitations
++~~~~~~~~~~~~~~~~~~~~~
++
++The lack of memory or disk volume would lead to decompression
++failed. For example, decompression bombs (aka `ZIP bomb`_)
++apply to zipfile library that can cause disk volume exhaustion.
++
++Interruption
++~~~~~~~~~~~~
++
++Interruption during the decompression, such as pressing control-C or killing the
++decompression process may result in incomplete decompression of the archive.
++
++Default behaviors of extraction
++~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++
++Not knowing the default extraction behaviors
++can cause unexpected decompression results.
++For example, when extracting the same archive twice,
++it overwrites files without asking.
++
+
++.. _ZIP bomb: https://en.wikipedia.org/wiki/Zip_bomb
+ .. _PKZIP Application Note: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
+diff --git a/Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst b/Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst
+new file mode 100644
+index 0000000..9276516
+--- /dev/null
++++ b/Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst
+@@ -0,0 +1 @@
++Add decompression pitfalls to zipfile module documentation.
+\ No newline at end of file
+--
+2.23.0
diff --git a/python2.spec b/python2.spec
index 460d522c6471138f555d8a42bfad25a7ff114d34..147fc031ac7e8e3f77e0c531cf9a20060f18ec35 100644
--- a/python2.spec
+++ b/python2.spec
@@ -15,7 +15,7 @@
 %undefine _debuginfo_subpackages
 Name:      python2
 Version:   2.7.16
-Release:   15
+Release:   16
 Summary:   Python is an interpreted, interactive object-oriented programming language suitable
 License:   Python
 URL:       https://www.python.org/
@@ -100,6 +100,7 @@ Patch372: CVE-2019-17514.patch
 Patch373: CVE-2017-18207.patch
 Patch374: bugfix-excessive-memory-usage-when-using-regular-expressions.patch
 Patch375: CVE-2020-8492.patch
+Patch376: CVE-2019-9674.patch
 
 BuildRequires: libdb-devel libffi-devel valgrind-devel ncurses-devel expat-devel readline-devel
 BuildRequires: openssl-devel libtirpc-devel tcl-devel tk-devel glibc-devel libnsl2-devel
@@ -634,6 +635,12 @@ sed -e "s|LIBRARY_PATH|%{_libdir}/%{py_INSTSONAME_debug}|" %{SOURCE1} \
 %{dynload_dir}/_testcapimodule_d.so
 
 %changelog
+* Tue May 19 2020 hanxinke<hanxinke@huawei.com> - 2.7.16-16
+- Type:cves
+- ID:CVE-2019-9674
+- SUG:NA
+- DESC:improved the documentation to reflect the risks of zip-bombs
+
 * Fri Mar 6 2020 hanxinke<hanxinke@huawei.com> - 2.7.16-15
 - Type:cves
 - ID:CVE-2020-8492