diff --git a/ChangeLog.d/tls13-transform-resource-leak.txt b/ChangeLog.d/tls13-transform-resource-leak.txt
new file mode 100644
index 0000000000..f8008e4723
--- /dev/null
+++ b/ChangeLog.d/tls13-transform-resource-leak.txt
@@ -0,0 +1,4 @@
+Bugfix
+   * Fix a resource leak in TLS 1.3 transform setup when importing the
+     decryption traffic key fails after the encryption traffic key has already
+     been imported. Fixes #10917.