diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index 98efddce73..27bef03dd2 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -79,6 +79,7 @@
         <packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
         <cve>CVE-2018-10237</cve>
         <cve>CVE-2020-8908</cve>
+        <cve>CVE-2023-2976</cve>
     </suppress>
 
     <!-- https://issues.apache.org/jira/browse/CASSANDRA-18146 -->
diff --git a/CHANGES.txt b/CHANGES.txt
index 0aed2d9f62..d86b27595f 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,6 +1,8 @@
 3.11.16
  * Remove unnecessary String.format invocation in QueryProcessor when getting a prepared statement from cache (CASSANDRA-17202)
 Merged from 3.0:
+3.0.30
+ * Suppress CVE-2023-2976 (CASSANDRA-18562)
  * Remove dh_python use in Debian packaging (CASSANDRA-18558)
  * Pass down all contact points to driver for cassandra-stress (CASSANDRA-18025)
  * Validate the existence of a datacenter in nodetool rebuild (CASSANDRA-14319)