diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index 6c2e52c3ca..9a5da808fa 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -35,6 +35,13 @@
         <cve>CVE-2021-4235</cve>
         <cve>CVE-2017-18640</cve>
     </suppress>
+
+    <!-- https://issues.apache.org/jira/browse/CASSANDRA-18943 -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/io\.netty/netty\-.*@.*$</packageUrl>
+        <cve>CVE-2023-44487</cve>
+    </suppress>
+
     <!-- https://issues.apache.org/jira/browse/CASSANDRA-17966 -->
     <suppress>
         <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
diff --git a/CHANGES.txt b/CHANGES.txt
index e3a8ff051b..2bc545c9f7 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -36,6 +36,8 @@ Merged from 4.0:
 Merged from 3.11:
  * Revert CASSANDRA-18543 (CASSANDRA-18854)
 Merged from 3.0:
+ * Suppress CVE-2023-44487 (CASSANDRA-18943)
+ * Implement the logic in bin/stop-server (CASSANDRA-18838)
  * Fix nodetool enable/disablebinary to correctly set rpc readiness in gossip (CASSANDRA-18935)
  * Implement the logic in bin/stop-server (CASSANDRA-18838) 
  * Upgrade snappy-java to 1.1.10.4 (CASSANDRA-18878)