diff --git a/CHANGES b/CHANGES
index fa3fc0573..45a674ce3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,8 @@
-(to be released) - 2.9.x
-------------------------
+21 May 2025 - 2.9.9
+-------------------
 
+ * fix: DoS vulnerability
+   [PR from private repo - @theseion, @fzipi, @airween; fixed CVE-2025-47947]
  * chore: log error codes for global mutex failure modes.
    [Issue #3387 - @airween]
  * chore: refactor build system to use PCRE2
diff --git a/apache2/msc_release.h b/apache2/msc_release.h
index 5c4dbc96d..fb88a7cce 100644
--- a/apache2/msc_release.h
+++ b/apache2/msc_release.h
@@ -38,7 +38,7 @@
 
 #define MODSEC_VERSION_MAJOR       "2"
 #define MODSEC_VERSION_MINOR       "9"
-#define MODSEC_VERSION_MAINT       "8"
+#define MODSEC_VERSION_MAINT       "9"
 #define MODSEC_VERSION_TYPE        ""
 #define MODSEC_VERSION_RELEASE     ""