diff --git a/pom.xml b/pom.xml
index 35052c48aea..352ef9c67e3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1258,7 +1258,7 @@
         <dependency>
             <groupId>commons-codec</groupId>
             <artifactId>commons-codec</artifactId>
-            <version>1.16.1</version>
+            <version>1.17.0</version>
         </dependency>
         <dependency>
             <groupId>org.brotli</groupId>
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 561a0f53c17..8cc686ab84e 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -27,6 +27,9 @@
                 Deprecated http status code constants removed from WebResponse.
             </action>
 
+            <action type="update" dev="rbri">
+                Upgrade commons-codec to 1.17.0.
+            </action>
             <action type="remove" dev="rbri">
                 Internal class WebClientInternals removed.
             </action>