diff --git a/ChangeLog b/ChangeLog
index 0a857ba..0c9c444 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,14 @@
 mbed TLS ChangeLog (Sorted per branch, date)
 
+= mbed TLS x.x.x branch released xxxx-xx-xx
+
+Security
+    * Add checks to prevent signature forgeries for very large messages while
+      using RSA through the PK module in 64-bit systems. The issue was caused by
+      some data loss when casting a size_t to an unsigned int value in the
+      functions rsa_verify_wrap(), rsa_sign_wrap(), rsa_alt_sign_wrap() and
+      mbedtls_pk_sign(). Found by Jean-Philippe Aumasson.
+
 = mbed TLS 2.4.1 branch released 2016-12-13
 
 Changes