diff --git a/CHANGES b/CHANGES
index 1571df4fe2..5217019447 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
-3538.	[test]	Running "make test" now requires loopback interfaces to be 
-	 		set up. [RT #32452]
+3538.	[test]		Running "make test" now requires loopback interfaces
+			to be set up. [RT #32452]
 
 3537.	[tuning]	Slave zones, when updated, now send NOTIFY messages
 			to peers before being dumped to disk rather than
@@ -140,8 +140,10 @@
 			terse, and none. "yes" and "no" are retained as
 			synonyms for full and terse, respectively. [RT #29165]
 
-3500.	[port]		Support NAPTR regular expression validation on
-			all platforms.  [RT #32688]
+3500.	[security]	Support NAPTR regular expression validation on
+			all platforms without using libregex, which
+			can be vulnerable to memory exhaustion attack
+			(CVE-2013-2266). [RT #32688]
 
 3499.	[doc]		Corrected ARM documentation of built-in zones.
 			[RT #32694]