Add release note for CVE-2026-11622

diff --git a/doc/notes/notes-9.21.24.rst b/doc/notes/notes-9.21.24.rst
index d8eb5909229c71d1128766e6159038b6402887f4..ae39303237d885d2eaf2705c6e8cd69f86b089be 100644 (file)
--- a/doc/notes/notes-9.21.24.rst
+++ b/doc/notes/notes-9.21.24.rst
@@ -91,6 +91,12 @@ Security Fixes
   now enforces that limit on negative answers and returns SERVFAIL once
   the limit is reached. :gl:`#4463`
 
+- Prevent cache exhaustion under sustained attack. :cve:`2026-11622`
+
+  Cache memory could become exhausted with expired entries whose memory
+  was not released, due to a sustained attack on the same DNS name that
+  prevented the cleanup. This has been fixed. :gl:`#4760`
+
 Removed Features
 ~~~~~~~~~~~~~~~~