From e55d0b76ed5980c1ac46169b37bdbe0ea3fbb466 Mon Sep 17 00:00:00 2001
From: Ronald Cron <ronald.cron@arm.com>
Date: Wed, 10 Jun 2026 10:47:57 +0200
Subject: [PATCH] Add change log

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
---
 ChangeLog.d/drop-early-data.txt | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 ChangeLog.d/drop-early-data.txt

diff --git a/ChangeLog.d/drop-early-data.txt b/ChangeLog.d/drop-early-data.txt
new file mode 100644
index 0000000000..dc597a23f0
--- /dev/null
+++ b/ChangeLog.d/drop-early-data.txt
@@ -0,0 +1,7 @@
+Security
+   * Fixed a TLS 1.3 record-boundary validation issue that could allow
+     unauthenticated plaintext data to be processed across a key change. In
+     servers with MBEDTLS_SSL_EARLY_DATA enabled, this could be exploited by a
+     man-in-the-middle attacker to cause loss of 0-RTT early data.
+     Reported by Ben Smyth.
+     CVE-2026-TODO.