diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index bd6f90da62..6ed01952be 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -60,6 +60,7 @@
     <!-- this was fixed in 3.0.22 -->
     <suppress>
         <packageUrl regex="true">^pkg:maven/com\.datastax\.cassandra/cassandra\-driver\-core@.*$</packageUrl>
+        <cve>CVE-2019-2684</cve>
         <cve>CVE-2020-13946</cve>
         <cve>CVE-2020-17516</cve>
         <cve>CVE-2021-44521</cve>
diff --git a/CHANGES.txt b/CHANGES.txt
index cbe38d02b3..830dca3b50 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -7,6 +7,7 @@
  * Creating of a keyspace on insufficient number of replicas should filter out gosspping-only members (CASSANDRA-17759)
  * Only use statically defined subcolumns when determining column definition for supercolumn cell (CASSANDRA-14113)
 Merged from 3.0:
+ * Suppress CVE-2019-2684 (CASSANDRA-17965)
  * Fix auto-completing "WITH" when creating a materialized view (CASSANDRA-17879)
  * Fix scrubber falling into infinite loop when the last partition is broken (CASSANDRA-17862)
  * Improve libjemalloc resolution in bin/cassandra (CASSANDRA-15767)