diff --git a/CHANGELOG.md b/CHANGELOG.md
index f6bf9d0e..83a3af0d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## [7.3.1]
+
+- Prevent Host header injection attacks on the password recovery endpoint. A new setting
+  `commafeed.password-recovery-public-base-url` has been added to specify the base URL to use in password recovery
+  emails. This setting is only required when the password recovery feature is enabled, which is not the default.
+
 ## [7.3.0]
 
 - Add support for the Google Reader API for native mobile apps that don't support the Fever API
diff --git a/commafeed-client/pom.xml b/commafeed-client/pom.xml
index ca908089..d44b1b47 100644
--- a/commafeed-client/pom.xml
+++ b/commafeed-client/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>com.commafeed</groupId>
 		<artifactId>commafeed</artifactId>
-		<version>7.3.0</version>
+		<version>7.3.1</version>
 	</parent>
 	<artifactId>commafeed-client</artifactId>
 	<name>CommaFeed Client</name>
diff --git a/commafeed-server/pom.xml b/commafeed-server/pom.xml
index ffcd4e6d..f0916610 100644
--- a/commafeed-server/pom.xml
+++ b/commafeed-server/pom.xml
@@ -6,7 +6,7 @@
     <parent>
         <groupId>com.commafeed</groupId>
         <artifactId>commafeed</artifactId>
-        <version>7.3.0</version>
+        <version>7.3.1</version>
     </parent>
     <artifactId>commafeed-server</artifactId>
     <name>CommaFeed Server</name>
@@ -302,7 +302,7 @@
         <dependency>
             <groupId>com.commafeed</groupId>
             <artifactId>commafeed-client</artifactId>
-            <version>7.3.0</version>
+            <version>7.3.1</version>
         </dependency>
 
         <!-- compile-time processors -->
diff --git a/pom.xml b/pom.xml
index c64141b6..b8f4f2f8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
 
 	<groupId>com.commafeed</groupId>
 	<artifactId>commafeed</artifactId>
-	<version>7.3.0</version>
+	<version>7.3.1</version>
 	<name>CommaFeed</name>
 	<packaging>pom</packaging>