diff --git a/log4j-parent/pom.xml b/log4j-parent/pom.xml
index 6faa56a01a7..ec34a1c3116 100644
--- a/log4j-parent/pom.xml
+++ b/log4j-parent/pom.xml
@@ -73,7 +73,7 @@
     <commons-codec.version>1.16.0</commons-codec.version>
     <commons-compress.version>1.25.0</commons-compress.version>
     <commons-csv.version>1.10.0</commons-csv.version>
-    <commons-dbcp2.version>2.9.0</commons-dbcp2.version>
+    <commons-dbcp2.version>2.11.0</commons-dbcp2.version>
     <commons-io.version>2.15.1</commons-io.version>
     <commons-lang3.version>3.14.0</commons-lang3.version>
     <commons-logging.version>1.3.0</commons-logging.version>
diff --git a/src/changelog/.2.x.x/update_org_apache_commons_commons_dbcp2.xml b/src/changelog/.2.x.x/update_org_apache_commons_commons_dbcp2.xml
new file mode 100644
index 00000000000..01671eaa968
--- /dev/null
+++ b/src/changelog/.2.x.x/update_org_apache_commons_commons_dbcp2.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="http://logging.apache.org/log4j/changelog"
+       xsi:schemaLocation="http://logging.apache.org/log4j/changelog https://logging.apache.org/log4j/changelog-0.1.2.xsd"
+       type="changed">
+  <issue id="2048" link="https://github.com/apache/logging-log4j2/pull/2048"/>
+  <description format="asciidoc">Update `org.apache.commons:commons-dbcp2` to version `2.11.0`</description>
+</entry>
diff --git a/src/site/_release-notes/_2.x.x.adoc b/src/site/_release-notes/_2.x.x.adoc
index a56bd3af915..0abde6cf157 100644
--- a/src/site/_release-notes/_2.x.x.adoc
+++ b/src/site/_release-notes/_2.x.x.adoc
@@ -37,6 +37,7 @@ This releases contains ...
 * Update `org.apache.activemq:activemq-broker` to version `6.0.1` (https://github.com/apache/logging-log4j2/pull/2043[2043])
 * Update `org.apache.aries.spifly:org.apache.aries.spifly.dynamic.bundle` to version `1.3.7` (https://github.com/apache/logging-log4j2/pull/2058[2058])
 * Update `org.apache.commons:commons-compress` to version `1.25.0` (https://github.com/apache/logging-log4j2/pull/2045[2045])
+* Update `org.apache.commons:commons-dbcp2` to version `2.11.0` (https://github.com/apache/logging-log4j2/pull/2048[2048])
 * Update `org.apache.commons:commons-lang3` to version `3.14.0` (https://github.com/apache/logging-log4j2/pull/2047[2047])
 * Update `org.apache.commons:commons-pool2` to version `2.12.0` (https://github.com/apache/logging-log4j2/pull/2057[2057])
 * Update `org.apache.kafka:kafka-clients` to version `3.6.0` (https://github.com/apache/logging-log4j2/pull/2060[2060])