diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6e1c4bc9f8..e0a3ea002c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,12 +6,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.3] - 11/30/2021
+
+### Fixed
+
+* Set the last byte in allocated char array to zero [cherry picked from #650] (#699)
+
 ## [0.11.2] - 11/29/2021
 
 ### Added
 - Extending `dpctl.device_context` with nested contexts (#678)
 
-## Fixed
+### Fixed
 - Fixed issue #649 about incorrect behavior of `.T` method on sliced arrays (#653)
 
 ## [0.11.1] - 11/10/2021
diff --git a/dpctl-capi/helper/include/dpctl_string_utils.hpp b/dpctl-capi/helper/include/dpctl_string_utils.hpp
index 3b1d0ae73c..aa1a8a9535 100644
--- a/dpctl-capi/helper/include/dpctl_string_utils.hpp
+++ b/dpctl-capi/helper/include/dpctl_string_utils.hpp
@@ -50,6 +50,11 @@ cstring_from_string(const std::string &str)
 #else
         std::strncpy(cstr, str.c_str(), cstr_len);
 #endif
+        // Added to resolve CheckMarx's false positive.
+        // NB: This is redundant because str.c_str() is guaranteed
+        // to be null-terminated and the copy function is asked to
+        // copy enough characters to include that null-character.
+        cstr[cstr_len - 1] = '\0';
     } catch (std::bad_alloc const &ba) {
         // \todo log error
         std::cerr << ba.what() << '\n';