diff --git a/py-matrix-synapse/TODO b/py-matrix-synapse/TODO
index b595ce98e1..0607f267c0 100644
--- a/py-matrix-synapse/TODO
+++ b/py-matrix-synapse/TODO
@@ -1,2 +1,2 @@
 This package has known vulnerabilities, please investigate and fix if possible:
- CVE-2018-10657, CVE-2018-12291, CVE-2018-12423, CVE-2018-16515
+ CVE-2018-10657, CVE-2018-12291, CVE-2018-12423, CVE-2018-16515, CVE-2019-5885