diff --git a/ChangeLog.d/tls13-hrr-selected-group.txt b/ChangeLog.d/tls13-hrr-selected-group.txt
new file mode 100644
index 0000000000..20d7a18fbd
--- /dev/null
+++ b/ChangeLog.d/tls13-hrr-selected-group.txt
@@ -0,0 +1,5 @@
+Security
+   * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was
+     not advertised in the original ClientHello. Reported by
+     Din Asotić / Xiangdong Li, Beijing University of Posts and
+     Telecommunications (BUPT)