diff --git a/THANKS b/THANKS
index 2787c67..9d1643a 100644
--- a/THANKS
+++ b/THANKS
@@ -12,3 +12,6 @@ Zak Johnson fixed substring matches in ldap_match_mapped.
 
 Andreas Stührk found a possible integer underflow in the indexing code.
 I'd be astounded if someone found a way to exploit it, though.
+
+Andreas also ran tinyldap in afl and found two double frees.
+At least one of them looks like it might be exploitable.