Add release notes entry

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index b5362fb5ad60b4dd51a587e0afbeab0a0f00076f..35bfeb40caf939f34d9817eda1ea7aadafdc9cba 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -14,6 +14,14 @@ Notes for BIND 9.17.2
 Security Fixes
 ~~~~~~~~~~~~~~
 
+-  To prevent exhaustion of server resources by a maliciously configured
+   domain, the number of recursive queries that can be triggered by a
+   request before aborting recursion has been further limited. Root and
+   top-level domain servers are no longer exempt from the
+   ``max-recursion-queries`` limit. Fetches for missing name server
+   address records are limited to 4 for any domain. This issue was
+   disclosed in CVE-2020-8616. [GL #1388]
+
 -  Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. This was disclosed in CVE-2020-8617. [GL #1703]