diff --git a/doc/arm/notes-9.16.3.xml b/doc/arm/notes-9.16.3.xml
index 6bbef64b95..bfb302b40f 100644
--- a/doc/arm/notes-9.16.3.xml
+++ b/doc/arm/notes-9.16.3.xml
@@ -15,7 +15,9 @@
     <itemizedlist>
       <listitem>
         <para>
-          None.
+          Replaying a TSIG BADTIME response as a request could
+          trigger an assertion failure. This was disclosed in
+          CVE-2020-8617. [GL #1703]
         </para>
       </listitem>
     </itemizedlist>