Add CHANGES note for [GL #2950]

diff --git a/CHANGES b/CHANGES
index 95345869ecf3fb756212f1a052b735d1752c5680..6b1f0662917ff1433f888bca20d6da0b0560241a 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+5817.  [security]      The rules for acceptance of records into the cache
+                       have been tightened to prevent the possibility of
+                       poisoning if forwarders send records outside
+                       the configured bailiwick. (CVE-2021-25220) [GL #2950]
+
 5816.  [bug]           Make BIND compile with LibreSSL 3.5.0, as it was using
                        not very accurate pre-processor checks for using shims.
                        [GL #3172]