diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index 481d8d0b3f..71d4672bc3 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -49,6 +49,23 @@
         <packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
         <cve>CVE-2020-8908</cve>
     </suppress>
+    <!-- https://issues.apache.org/jira/browse/CASSANDRA-18146 -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/org\.apache\.commons.*$</packageUrl>
+        <cve>CVE-2021-37533</cve>
+    </suppress>
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/commons-io/.*$</packageUrl>
+        <cve>CVE-2021-37533</cve>
+    </suppress>
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/commons-cli/.*$</packageUrl>
+        <cve>CVE-2021-37533</cve>
+    </suppress>
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/commons-codec/.*$</packageUrl>
+        <cve>CVE-2021-37533</cve>
+    </suppress>
     <!-- netty's http stuff is not applicable here -->
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-all@.*$</packageUrl>
diff --git a/CHANGES.txt b/CHANGES.txt
index 017e5748b9..5b0da3ae7d 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -7,6 +7,7 @@ Merged from 4.0:
  * Restore internode custom tracing on 4.0's new messaging system (CASSANDRA-17981)
 Merged from 3.11:
 Merged from 3.0:
+ * Suppress CVE-2021-37533 (CASSANDRA-18146)
  * Add to the IntelliJ Git Window issue navigation links to Cassandra's Jira (CASSANDRA-18126)
  * Avoid anticompaction mixing data from two different time windows with TWCS (CASSANDRA-17970)
  * Do not spam the logs with MigrationCoordinator not being able to pull schemas (CASSANDRA-18096)