diff --git a/CHANGES b/CHANGES
index 92d9d414..c358fa9e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -14,6 +14,11 @@ The following undocumented functions are deprecated and scheduled for removal:
 - ``ldap.cidict.strlist_minus``
 - ``ldap.cidict.strlist_union``
 
+Security fixes:
+* Fix inefficient regular expression which allows denial-of-service attacks
+  when parsing specially-crafted LDAP schema.
+  (GHSL-2021-117)
+
 Changes:
 * On MacOS, remove option to make LDAP connections from a file descriptor
   when built with the system libldap (which lacks the underlying function,
diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
index 69823f2b..623b86d5 100644
--- a/Lib/ldap/schema/tokenizer.py
+++ b/Lib/ldap/schema/tokenizer.py
@@ -13,7 +13,7 @@
     r"|"              # or
     r"([^'$()\s]+)"   # string of length >= 1 without '$() or whitespace
     r"|"              # or
-    r"('(?:[^'\\]|\\\\|\\.)*?'(?!\w))"
+    r"('(?:[^'\\]|\\.)*'(?!\w))"
                       # any string or empty string surrounded by unescaped
                       # single quotes except if right quote is succeeded by
                       # alphanumeric char