diff --git a/ChangeLog.d/sig_algs_check.txt b/ChangeLog.d/sig_algs_check.txt
new file mode 100644
index 0000000000..b0aed6dfd3
--- /dev/null
+++ b/ChangeLog.d/sig_algs_check.txt
@@ -0,0 +1,5 @@
+Security
+   * Fix a bug in the TLS 1.2 client's signature algorithm check, which caused
+     the client to accept server key exchange messages signed with a signature
+     algorithm explicitly disallowed by the client. Found and reported by
+     EFR-GmbH and M. Heuft of Security-Research-Consulting GmbH. CVE-2026-25834