diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt
new file mode 100644
index 0000000000..a0e698c077
--- /dev/null
+++ b/ChangeLog.d/oob-key-exchange-restricted.txt
@@ -0,0 +1,3 @@
+Security
+   * Fix an out-of-bounds read in TLS 1.2 ECJPAKE ServerKeyExchange parsing.
+     Reported-by Biniam Demissie