diff --git a/CHANGES.txt b/CHANGES.txt
index e662d54bb9..fdb19e0cf0 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -4,6 +4,7 @@ Merged from 4.0:
  * Remove redundant code in StorageProxy#sendToHintedReplicas (CASSANDRA-19412)
  * Remove bashisms for mx4j tool in cassandra-env.sh (CASSANDRA-19416)
 Merged from 3.11:
+ * Move ClientWarn.State#warnings to a thread-safe list (CASSANDRA-19427)
 Merged from 3.0:
  * Fix SCM URL link (CASSANDRA-19422)
 
diff --git a/src/java/org/apache/cassandra/service/ClientWarn.java b/src/java/org/apache/cassandra/service/ClientWarn.java
index 6e2d3fcdb1..c329ef8f67 100644
--- a/src/java/org/apache/cassandra/service/ClientWarn.java
+++ b/src/java/org/apache/cassandra/service/ClientWarn.java
@@ -17,7 +17,7 @@
  */
 package org.apache.cassandra.service;
 
-import java.util.ArrayList;
+import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.List;
 
 import org.apache.cassandra.concurrent.ExecutorLocals;
@@ -71,7 +71,9 @@ public class ClientWarn extends ExecutorLocals.Impl
 
     public static class State
     {
-        private final List<String> warnings = new ArrayList<>();
+        // This must be a thread-safe list. Even though it's wrapped in a ThreadLocal, it's propagated to each thread
+        // from shared state, so multiple threads can reference the same State.
+        private final List<String> warnings = new CopyOnWriteArrayList<>();
 
         private void add(String warning)
         {