2 files changed, 2 insertions, 0 deletions
diff --git a/CHANGES b/CHANGES
index 291a0f0e..0f8af030 100644
--- a/CHANGES
+++ b/CHANGES
@@ -11,6 +11,7 @@ Version 0.11.0
 
 Security:
 
+ * Fixed CVE-2010-0009: Apache CouchDB Timing Attack Vulnerability.
  * Added default cookie-authentication and users database.
  * Added Futon user interface for user signup and login.
  * Added per-database reader access control lists.
diff --git a/NEWS b/NEWS
index 8e369909..14934a1d 100644
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,7 @@ Version 0.11.0
 
 This version is a feature-freeze release candidate for Apache CouchDB 1.0.
 
+ * Fixed CVE-2010-0009: Apache CouchDB Timing Attack Vulnerability.
  * Added support for building a Windows installer as part of 'make dist'.
  * Added optional 'raw' binary collation for faster view builds where Unicode
    collation is not important.