diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 3fc6fae1fd..65346d0fb1 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -82,6 +82,11 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>
+	  Duplicate EDNS COOKIE options in a response could trigger
+	  an assertion failure. This flaw is disclosed in CVE-2016-2088.
+	  [RT #41809]
+	</p></li>
 <li class="listitem"><p>
 	  Insufficient testing when parsing a message allowed
 	  records with an incorrect class to be be accepted,
diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index a49e6c1e57..6675e97caa 100644
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -44,6 +44,11 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>
+	  Duplicate EDNS COOKIE options in a response could trigger
+	  an assertion failure. This flaw is disclosed in CVE-2016-2088.
+	  [RT #41809]
+	</p></li>
 <li class="listitem"><p>
 	  Insufficient testing when parsing a message allowed
 	  records with an incorrect class to be be accepted,