diff --git a/ChangeLog b/ChangeLog
index d4cf85b..2e12785 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,14 @@
 mbed TLS ChangeLog (Sorted per branch, date)
 
+= mbed TLS x.x.x branch released xxxx-xx-xx
+
+Security
+   * Fixed potential livelock during the parsing of a CRL in PEM format in
+     mbedtls_x509_crl_parse(). A string containing a CRL followed by trailing
+     characters after the footer could result in the execution of an infinite
+     loop. The issue can be triggered remotely. Found by Greg Zaverucha,
+     Microsoft.
+
 = mbed TLS 1.3.18 branch 2016-10-17
 
 Security
diff --git a/library/x509_crl.c b/library/x509_crl.c
index de2079f..0d92bb1 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -525,7 +525,7 @@
 
             pem_free( &pem );
         }
-        else if( ret != POLARSSL_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
+        else if( is_pem )
         {
             pem_free( &pem );
             return( ret );