diff --git a/pom.xml b/pom.xml
index 423f3962fbb0..7fab63e0734d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -90,7 +90,7 @@
         <jersey.version>1.19.3</jersey.version>
         <!-- jackson 2.7.x causes injection error and 2.8.x can't be used because avatica is using 2.6.3 -->
         <jackson.version>2.6.7</jackson.version>
-        <log4j.version>2.5</log4j.version>
+        <log4j.version>2.12.4</log4j.version>
         <!-- HttpClient has not yet been ported to Netty 4.x -->
         <netty3.version>3.10.6.Final</netty3.version>
         <!-- Spark updated in https://github.com/apache/spark/pull/19884 -->