diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index 68c97bb777..98efddce73 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -23,6 +23,7 @@
     <suppress>
         <!--  https://issues.apache.org/jira/browse/CASSANDRA-16150 -->
         <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
+        <cve>CVE-2023-2251</cve>
         <cve>CVE-2017-18640</cve>
         <cve>CVE-2022-25857</cve>
         <cve>CVE-2022-38749</cve>
diff --git a/CHANGES.txt b/CHANGES.txt
index d80d0be71e..b132527d5c 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,3 +1,7 @@
+3.11.16
+Merged from 3.0:
+ * Suppress CVE-2023-2251 (CASSANDRA-18497)
+
 3.11.15
  * Fix the capital P usage in the CQL parser (CASSANDRA-17919)
  * Fix sstable_count metric missing from tablestats json/yaml output (CASSANDRA-18448)