diff --git a/CHANGES b/CHANGES
index 50dd850ca4..a58674d956 100644
--- a/CHANGES
+++ b/CHANGES
@@ -47,8 +47,8 @@
 4254.	[bug]		Address missing lock when getting zone's serial.
 			[RT #41072]
 
-4253.	[bug]		Address fetch context reference count handling error
-			on socket error.  [RT#40945]
+4253.	[security]	Address fetch context reference count handling error
+			on socket error. (CVE-2015-8461)  [RT#40945]
 
 4252.	[func]		Add support for automating the generation CDS and
 			CDNSKEY rrsets to named and dnssec-signzone.