diff --git a/documentation/RELEASE_NOTES.html b/documentation/RELEASE_NOTES.html
index 192dee6..1f0a423 100644
--- a/documentation/RELEASE_NOTES.html
+++ b/documentation/RELEASE_NOTES.html
@@ -1,6 +1,16 @@
-<h1>Release 5.0</h1>
+<h1>Release 5.0.3</h1>
 
-<p>The main changes since release 4.0 are:</p>
+<p>The only change since release 5.0.2 is:</p>
+
+<h2>Fixed buffer overflow in PVUnion::serialize() (issue #20)</h2>
+
+<p>A PVUnion whose stored value was null was serialized without checking 
+whether the buffer had sufficient capacity. This has been fixed by calling
+ensureBuffer().</p>
+
+<h1>Release 5.0.2</h1>
+
+<p>The main changes since release 4.0.3 are:</p>
 
 <ul>
 <li>Deprecated getXXXField() methods have been removed from PVStructure</li>
@@ -133,7 +143,7 @@ pvData had issues due to PVStructure::DEFAULT_ID being used before being initial
 This has been changed so the it returns a null pvStructure
 and provides an error.</p>
 
-<h1>Release 4.0</h1>
+<h1>Release 4.0.3</h1>
 
 <p>The main changes since release 3.0.2 are:</p>
 
diff --git a/documentation/RELEASE_NOTES.md b/documentation/RELEASE_NOTES.md
index 17784b7..20abbb2 100644
--- a/documentation/RELEASE_NOTES.md
+++ b/documentation/RELEASE_NOTES.md
@@ -1,7 +1,20 @@
-Release 5.0
-===========
+Release 5.0.3
+=============
 
-The main changes since release 4.0 are:
+The only change since release 5.0.2 is:
+
+Fixed buffer overflow in PVUnion::serialize() (issue #20)
+---------------------------------------------------------
+
+A PVUnion whose stored value was null was serialized without checking 
+whether the buffer had sufficient capacity. This has been fixed by calling
+ensureBuffer().
+
+
+Release 5.0.2
+=============
+
+The main changes since release 4.0.3 are:
 
 * Deprecated getXXXField() methods have been removed from PVStructure
 * Convert copy methods and equals operators (re)moved
@@ -15,7 +28,7 @@ The main changes since release 4.0 are:
 
 
 Deprecated getXXXField methods have been removed from PVStructure
--------------------------------------------------------------------
+-----------------------------------------------------------------
 
 The following methods have been removed from PVStructure
 
@@ -141,8 +154,8 @@ This has been changed so the it returns a null pvStructure
 and provides an error.
 
 
-Release 4.0
-===========
+Release 4.0.3
+=============
 
 The main changes since release 3.0.2 are: