diff --git a/CHANGES b/CHANGES
index b31c6b578b..b8a58ab953 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,9 @@
-        --- 9.11.10 released ---
+5279.	[bug]		When loading, reject zones containing CDS or CDNSKEY
+			RRsets at the zone apex if they would cause DNSSEC
+			validation failures if published in the parent zone
+			as the DS RRset.  [GL #1187]
+
+	--- 9.11.10 released ---
 
 5275.	[bug]		Mark DS records included in referral messages
 			with trust level "pending" so that they can be