diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index 35d9bd096f..3c81e79c17 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -38,6 +38,10 @@
         <cve>CVE-2022-38751</cve>
         <cve>CVE-2022-38752</cve>
         <cve>CVE-2022-41854</cve>
+        <cve>CVE-2021-1471</cve>
+        <cve>CVE-2021-3064</cve>
+        <cve>CVE-2021-4235</cve>
+        <cve>CVE-2017-18640</cve>
     </suppress>
     <suppress>
         <!-- dependency checker identified this as a completely different package (wire) -->
diff --git a/CHANGES.txt b/CHANGES.txt
index 28589bbc6c..936997bf1b 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -112,6 +112,7 @@ Merged from 4.0:
  * Restore internode custom tracing on 4.0's new messaging system (CASSANDRA-17981)
 Merged from 3.11:
 Merged from 3.0:
+ * Suppress CVE-2021-1471, CVE-2021-3064, CVE-2021-4235 (CASSANDRA-18149)
  * Switch to snakeyaml's SafeConstructor (CASSANDRA-18150)
  * Expand build.dir property in rat targets (CASSANDRA-18183)
  * Suppress CVE-2022-41881 (CASSANDRA-18148)