diff --git a/ChangeLog.d/x509-crt-parse-basicConstraints.txt b/ChangeLog.d/x509-crt-parse-basicConstraints.txt
index c5b25f114b..4fd450e18e 100644
--- a/ChangeLog.d/x509-crt-parse-basicConstraints.txt
+++ b/ChangeLog.d/x509-crt-parse-basicConstraints.txt
@@ -1,7 +1,15 @@
 Security
-   * Fix a bug in the X.509 certificate parser that caused some inputs
+   * Fix two bugs in the X.509 certificate parser that caused some inputs
      with a malformed basicConstraints extension to be accepted. This
      could have dangerous results, in particular causing some certificates
      to be parsed as CA certificates when other X.509 implementations would
      parse them as end-entity certificates. Reported by Mohammad Seet
      (mhdsait101). CVE-2026-TODO
+
+Changes
+   * X.509 certificates with a basicConstraints extension starting with an
+     INTEGER field are no longer accepted. According to RFC 5280, such
+     certificates are syntactically valid and the first field is the
+     pathLenConstraint value, but certificate authorities must not emit such
+     certificates. Mbed TLS interpreted it as a cA value, which was nonstandard
+     and dangerous.