diff --git a/ChangeLog b/ChangeLog
index dc27e50..b6d5adc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -70,6 +70,9 @@
 = mbed TLS 1.3 branch
 
 Security
+   * With authmode set to MBEDTLS_SSL_VERIFY_OPTIONAL, verification of keyUsage and
+     extendedKeyUsage on the leaf certificate was lost (results not accessible
+     via ssl_get_verify_results()).
 
 Features
    * Add mbedtls_x509_crt_verify_info() to display certificate verification results.