Add a line for datallah's cd529e1158d3.

There's already a line in here for setting the max http fetch size
(added to ChangeLog in 0b8bec51e84b), but we should mention the
CVE, too.