diff --git a/bom/application/pom.xml b/bom/application/pom.xml
index 34b0452e2fe1f..a4c20ad87d664 100644
--- a/bom/application/pom.xml
+++ b/bom/application/pom.xml
@@ -95,7 +95,7 @@
         <jackson-bom.version>2.17.0</jackson-bom.version>
         <commons-logging-jboss-logging.version>1.0.0.Final</commons-logging-jboss-logging.version>
         <commons-lang3.version>3.14.0</commons-lang3.version>
-        <commons-codec.version>1.16.1</commons-codec.version>
+        <commons-codec.version>1.17.0</commons-codec.version>
         <classmate.version>1.7.0</classmate.version>
         <!-- WARNING: When updating, also align other properties on this version:
              bytebuddy.version (just below), hibernate-orm.version-for-documentation (in docs/pom.xml)
diff --git a/independent-projects/bootstrap/pom.xml b/independent-projects/bootstrap/pom.xml
index c2f192de80593..8b9e882f1d885 100644
--- a/independent-projects/bootstrap/pom.xml
+++ b/independent-projects/bootstrap/pom.xml
@@ -57,7 +57,7 @@
         <jakarta.annotation-api.version>3.0.0</jakarta.annotation-api.version>
         <jakarta.enterprise.cdi-api.version>4.1.0</jakarta.enterprise.cdi-api.version>
         <jakarta.inject-api.version>2.0.1</jakarta.inject-api.version>
-        <commons-codec.version>1.16.1</commons-codec.version>
+        <commons-codec.version>1.17.0</commons-codec.version>
         <commons-io.version>2.16.1</commons-io.version>
         <commons-lang.version>3.14.0</commons-lang.version>
         <guava.version>33.1.0-jre</guava.version>