diff --git a/CHANGELOG.md b/CHANGELOG.md
index 50cae31..20a4554 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Security
+
+* Update transitive dependency on org.apache.httpcomponents.core5:httpcore5 5.2.1 to 5.4.3 to address CVE.
+
 ## [4.0.2]
 
 ### Security
diff --git a/pom.xml b/pom.xml
index fc752bd..d525318 100644
--- a/pom.xml
+++ b/pom.xml
@@ -90,6 +90,17 @@
       <groupId>org.apache.thrift</groupId>
       <artifactId>libthrift</artifactId>
       <version>0.23.0</version>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.httpcomponents.core5</groupId>
+          <artifactId>httpcore5</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.httpcomponents.core5</groupId>
+      <artifactId>httpcore5</artifactId>
+      <version>5.4.3</version>
     </dependency>
 
     <dependency>