diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6efa8ac4c..1a41e812d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -295,6 +295,12 @@
   backtick-quoted `INSERT` column-name component before the by-name server-schema lookup, matching how the
   table and database identifiers are already handled. (https://github.com/ClickHouse/clickhouse-java/issues/2896)
 
+### Updated Dependencies
+
+- **[repo]** Upgraded `org.apache.httpcomponents.client5:httpclient5` from `5.4.4` to `5.6.4` in `client-v2` and
+  `clickhouse-http-client` to pick up the fixes of the newer 5.x releases, including known vulnerabilities.
+  (https://github.com/ClickHouse/clickhouse-java/issues/3078)
+
 ### Docs & Examples
 
 - **[examples]** Converted the remaining Gradle-based example projects (`client-v2-apache-arrow`, `demo-service`,
diff --git a/pom.xml b/pom.xml
index 15d4212be..997034129 100644
--- a/pom.xml
+++ b/pom.xml
@@ -79,7 +79,7 @@
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 
         <annotations-api.version>6.0.53</annotations-api.version>
-        <apache.httpclient.version>5.4.4</apache.httpclient.version>
+        <apache.httpclient.version>5.6.4</apache.httpclient.version>
         <arrow.version>12.0.1</arrow.version>
         <asm.version>9.7</asm.version>
         <avro.version>1.11.4</avro.version>