diff --git a/CHANGES b/CHANGES
index 7e243aafc9..999a3b68d2 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+5480.	[security]	When BIND 9 was compiled with native PKCS#11 support, it
+			was possible to trigger an assertion failure in code
+			determining the number of bits in the PKCS#11 RSA public
+			key with a specially crafted packet. (CVE-2020-8623)
+			[GL #2037]
+
 5476.	[security]	It was possible to trigger an assertion failure when
 			verifying the response to a TSIG-signed request.
 			(CVE-2020-8622) [GL #2028]
diff --git a/doc/arm/notes-9.11.22.xml b/doc/arm/notes-9.11.22.xml
index c11113318f..d01c65a70c 100644
--- a/doc/arm/notes-9.11.22.xml
+++ b/doc/arm/notes-9.11.22.xml
@@ -24,6 +24,18 @@
           of Oracle for bringing this vulnerability to our attention. [GL #2028]
         </para>
       </listitem>
+      <listitem>
+        <para>
+          When BIND 9 was compiled with native PKCS#11 support, it was possible
+          to trigger an assertion failure in code determining the number of bits
+          in the PKCS#11 RSA public key with a specially crafted packet. This
+          was disclosed in CVE-2020-8623.
+        </para>
+        <para>
+          ISC would like to thank Lyu Chiy for bringing this vulnerability to
+          our attention. [GL #2037]
+        </para>
+      </listitem>
     </itemizedlist>
   </section>