diff --git a/CHANGELOG.md b/CHANGELOG.md
index eec4bfa..d6642c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+* Updated [`h2`](https://github.com/hyperium/h2) from 0.3.16 to 0.3.17, fixes [SEC#11] ([#599])
+
+[#599]: https://github.com/vbrandl/hoc/pull/599
+
+[SEC#11]: https://github.com/vbrandl/hoc/security/dependabot/11
+
 
 ## [0.34.0] 2023-04-13
 
diff --git a/Cargo.lock b/Cargo.lock
index 5e74a6e..a21ed2d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1337,9 +1337,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.3.16"
+version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5be7b54589b581f624f566bf5d8eb2bab1db736c51528720b6bd36b96b55924d"
+checksum = "66b91535aa35fea1523ad1b86cb6b53c28e0ae566ba4a460f4457e936cad7c6f"
 dependencies = [
  "bytes",
  "fnv",