diff --git a/CHANGES.txt b/CHANGES.txt
index b707c12856..a7a7eeddd1 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -6,6 +6,7 @@ Merged from 3.0:
 
 
 3.11.12
+ * Extend operator control over the UDF threading model for CVE-2021-44521 (CASSANDRA-17352)
  * Upgrade snakeyaml to 1.26 in 3.11 (CASSANDRA=17028)
  * Add key validation to ssstablescrub (CASSANDRA-16969)
  * Update Jackson from 2.9.10 to 2.12.5 (CASSANDRA-16851)
diff --git a/NEWS.txt b/NEWS.txt
index b04f4b4437..1559aa8e4b 100644
--- a/NEWS.txt
+++ b/NEWS.txt
@@ -27,6 +27,24 @@ Logback has not been upgraded to avoid breaking deployments and customizations
 based on older versions. If you are using vulnerable components you will need
 to upgrade to a newer version of Logback or stop using the vulnerable components.
 
+PLEASE READ: CVE-2021-44521 SCRIPTED UDF SYSTEM ACCESS (CASSANDRA-17352)
+------------------------------------------------------------------------
+
+If you have enabled scripted UDFs and run without UDF threads in cassandra.yaml:
+
+    enable_user_defined_functions_threads: false
+
+an attacker could access java.lang.System methods and execute arbitrary code on
+the machine. Disabling UDF threads is still considered insecure and not recommended.
+
+To continue running without UDF threads you will need to set:
+
+    allow_insecure_udfs: true
+
+and if you need access to java.lang.System for existing UDFs, set:
+
+    allow_extra_insecure_udfs: true
+
 GENERAL UPGRADING ADVICE FOR ANY VERSION
 ========================================