diff --git a/CHANGELOG.md b/CHANGELOG.md
index abdc77273..7caabdb05 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - Bump `com.carrotsearch.randomizedtesting:randomizedtesting-runner` from 2.8.3 to 2.8.4 ([#1882](https://github.com/opensearch-project/opensearch-java/pull/1882))
 - Bump `com.github.jk1.dependency-license-report` from 3.0.1 to 3.1.1 ([#1895](https://github.com/opensearch-project/opensearch-java/pull/1895), [#1896](https://github.com/opensearch-project/opensearch-java/pull/1896))
 - Bump `org.apache.httpcomponents.core5:httpcore5-h2` from 5.4.1 to 5.4.2 ([#1919](https://github.com/opensearch-project/opensearch-java/pull/1919))
+- Bump `commons-logging:commons-logging` from 1.3.5 to 1.3.6 ([#1923](https://github.com/opensearch-project/opensearch-java/pull/1923))
 
 ### Added
 
diff --git a/java-client/build.gradle.kts b/java-client/build.gradle.kts
index ce42fd9b4..5ec31476b 100644
--- a/java-client/build.gradle.kts
+++ b/java-client/build.gradle.kts
@@ -183,7 +183,7 @@ dependencies {
     val jacksonDatabindVersion = "2.20.1"
 
     // Apache 2.0
-    api("commons-logging:commons-logging:1.3.5")
+    api("commons-logging:commons-logging:1.3.6")
     compileOnly("org.opensearch.client", "opensearch-rest-client", opensearchVersion)
     testImplementation("org.hamcrest:hamcrest:3.0")
     testImplementation("com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.8.4") {