diff --git a/ChangeLog b/ChangeLog
index 4212640731..5de97c5852 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -30,7 +30,7 @@ Security
      unauthenticated plaintext data to be processed across a key change. In
      servers with MBEDTLS_SSL_EARLY_DATA enabled, this could be exploited by a
      man-in-the-middle attacker to cause loss of 0-RTT early data.
-     Reported by Ben Smyth.
+     Reported by Ben Smyth. CVE-2026-73096
    * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when
      CBC is disabled. Reported by Karnakar Reddy. CVE-ID-50580
    * Fix a potential information disclosure in TLS 1.2 servers using session