diff --git a/release-notes/VERSION b/release-notes/VERSION
index 0f744dd7..4a9455a1 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -121,7 +121,7 @@ Project: woodstox
   for element undefined in DTD
  (reported by ChrisTrenkamp@github)
 #105: W3CSchemaFactory constructor incorrectly references relaxng
-#160: Add limit and configuration setting for maximum nesting for DTD subsets
+#160: Add limit and configuration setting for maximum nesting for DTD subsets [CVE-2022-xxxxx]
  (contributed by @pjfanning)
 
 5.3.0 (15-Jul-2019)