diff --git a/ChangeLog.d/ecdh-legacy-buffer-overflow.txt b/ChangeLog.d/ecdh-legacy-buffer-overflow.txt
new file mode 100644
index 0000000000..aa3b5811d8
--- /dev/null
+++ b/ChangeLog.d/ecdh-legacy-buffer-overflow.txt
@@ -0,0 +1,7 @@
+Security
+   * Possible buffer overflow in mbedtls_ecdh_calc_secret(): when the provided
+     output buffer is too small, sometimes (depending on the value of the
+     computed shared secret), the function would not return an error as it
+     should, but instead write past the end of the buffer, with consequences
+     that may range up to arbitrary code execution depending on what follows the
+     buffer. Reported by Eva Crystal (0xiviel) from XSource Security.