diff --git a/CHANGES b/CHANGES
index 0cfd91b52b..5decf23fc5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,10 @@
 
+2.5-402 | 2018-02-05 10:43:59 -0600
+
+  * Fix (unlikely) memory leak in nb_dns.c (Corelight)
+
+  * Remove bro-plugins submodule from .gitmodules file (Daniel Thayer)
+
 2.5-399 | 2018-01-30 14:31:45 -0800
 
   * Adapt the X509 analyzer to partially support OpenSSL 1.1.
diff --git a/VERSION b/VERSION
index d701ed64b5..29dcd1f939 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.5-399
+2.5-402
diff --git a/src/nb_dns.c b/src/nb_dns.c
index be6ca66059..a1f0d018dd 100644
--- a/src/nb_dns.c
+++ b/src/nb_dns.c
@@ -166,6 +166,7 @@ nb_dns_init(char *errstr)
 		}
 
 	snprintf(errstr, NB_DNS_ERRSIZE, "no valid nameservers in resolver config");
+	free(nd);
 	return (NULL);
 }