diff --git a/ChangeLog.d/pkcs7-padding-error-leak.txt b/ChangeLog.d/pkcs7-padding-error-leak.txt
new file mode 100644
index 0000000000..5d204d5bef
--- /dev/null
+++ b/ChangeLog.d/pkcs7-padding-error-leak.txt
@@ -0,0 +1,5 @@
+Security
+   * Fix a timing side channel in CBC-PKCS7 decryption that could
+     allow an attacker who can submit chosen ciphertexts to recover
+     some plaintexts through a timing-based padding oracle attack.
+     Credits to Beat Heeb from Oberon microsystems AG. CVE-TODO