diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5934923a5dd1d..f627a1ed73f69 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -147,7 +147,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `com.nimbusds:nimbus-jose-jwt` from 10.5 to 10.6 ([#20084](https://github.com/opensearch-project/OpenSearch/pull/20084))
 - Bump `commons-logging` from 1.2 to 1.3.5 ([#20156](https://github.com/opensearch-project/OpenSearch/pull/20156))
 - Bump `actions/checkout` from 5 to 6 ([#20186](https://github.com/opensearch-project/OpenSearch/pull/20186))
-- Bump `org.apache.commons:commons-configuration2` from 2.12.0 to 2.13.0 ([#20185](https://github.com/opensearch-project/OpenSearch/pull/20185))
+- Bump `org.apache.commons:commons-configuration2` from 2.12.0 to 2.13.0 ([#20185](https://github.com/opensearch-project/OpenSearch/pull/20185), [#20184](https://github.com/opensearch-project/OpenSearch/pull/20184))
 
 ### Deprecated
 - Deprecated existing constructors in ThreadPoolStats.Stats in favor of the new Builder ([#19317](https://github.com/opensearch-project/OpenSearch/pull/19317))
diff --git a/test/fixtures/hdfs-fixture/build.gradle b/test/fixtures/hdfs-fixture/build.gradle
index 543e8d6d51717..678234aafcd46 100644
--- a/test/fixtures/hdfs-fixture/build.gradle
+++ b/test/fixtures/hdfs-fixture/build.gradle
@@ -83,7 +83,7 @@ dependencies {
   api "ch.qos.logback:logback-classic:1.5.20"
   api "org.jboss.xnio:xnio-nio:3.8.17.Final"
   api 'org.jline:jline:3.30.5'
-  api 'org.apache.commons:commons-configuration2:2.12.0'
+  api 'org.apache.commons:commons-configuration2:2.13.0'
   api 'com.nimbusds:nimbus-jose-jwt:10.6'
   api ('org.apache.kerby:kerb-admin:2.1.0') {
     exclude group: "org.jboss.xnio"