diff --git a/CHANGES b/CHANGES
index 7234e46895..459113b109 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+3693.	[security]	memcpy was incorrectly called with overlapping
+			ranges resulting a malformed names being generated
+			on some platforms.  This was subsequently detected
+			resulting in INSIST failures when serving NSEC3
+			signed zones.  [RT #35120]
+
 	--- 9.6-ESV-R10-P1 released ---
 
 3656.	[bug]		Treat an all zero netmask as invalid when generating