diff --git a/changelog/security/2022-09-26-expat-2.4.9.md b/changelog/security/2022-09-26-expat-2.4.9.md
new file mode 100644
index 0000000000..9eeb5a5f34
--- /dev/null
+++ b/changelog/security/2022-09-26-expat-2.4.9.md
@@ -0,0 +1 @@
+- expat ([CVE-2022-40674](https://nvd.nist.gov/vuln/detail/CVE-2022-40674))
diff --git a/changelog/updates/2022-09-26-expat-2.4.9.md b/changelog/updates/2022-09-26-expat-2.4.9.md
new file mode 100644
index 0000000000..ebabc33986
--- /dev/null
+++ b/changelog/updates/2022-09-26-expat-2.4.9.md
@@ -0,0 +1 @@
+- expat ([2.4.9](https://github.com/libexpat/libexpat/blob/R_2_4_9/expat/Changes))