diff --git a/nginx.spec b/nginx.spec
index 540d0cd..b1da88c 100644
--- a/nginx.spec
+++ b/nginx.spec
@@ -28,8 +28,8 @@
 
 Name:              nginx
 Epoch:             1
-Version:           1.20.0
-Release:           5%{?dist}
+Version:           1.20.1
+Release:           1%{?dist}
 
 Summary:           A high performance web server and reverse proxy server
 # BSD License (two clause)
@@ -504,6 +504,11 @@ fi
 
 
 %changelog
+* Wed Jun 02 2021 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.1-1
+- new version 1.20.1
+- Resolves: #1964814 - CVE-2021-23017 nginx: Off-by-one in ngx_resolver_copy()
+  when labels are followed by a pointer to a root domain name
+
 * Fri Apr 30 2021 Lubos Uhliarik <luhliari@redhat.com> - 1:1.20.0-5
 - Resolves: #1955564 - [RFE] Support loading certificates from hardware
   token (PKCS#11)
diff --git a/sources b/sources
index 58190aa..852e9ea 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (nginx-1.20.0.tar.gz.asc) = adc401a3f26461caec4cb3404ff7f2034baa799e03c0a9cd5ddc058a7ef41c29efc03d93a3c9b1794092319f611e29182092b610600c6f6beca6b881138bc22d
-SHA512 (nginx-1.20.0.tar.gz) = 06433bde23610ab27deeb6bf8c78148e4249b603d194c81e71a08fc159caead07ea659510286fb6d02668d53b9afcdaabdde8692480ae83de4a531adc1b930ca
+SHA512 (nginx-1.20.1.tar.gz) = 3d9fd4bf2740eaf20fcc3c77260a3556aaf9dff2879afc2dbb5fff364dea27313ffbc51d335e9fc9c0186a2a44dac055ef60fde0d411b8cf842fdf661478c961
+SHA512 (nginx-1.20.1.tar.gz.asc) = 6e7dfaf199e9982faab265ada62a56861603499e03211d1792d9add5ac7bd971c9931b68b727fabdf7af66fcfb7b3e3dc2e9efa5e55b25b8186b7974f0f4823a