diff --git a/build.gradle b/build.gradle
index b3d885a8f37..1fcdbd39118 100644
--- a/build.gradle
+++ b/build.gradle
@@ -54,7 +54,7 @@ ext {
 	rxjava2Version       = "2.1.17"
 	slf4jVersion         = "1.7.26"	  // spring-jcl + consistent 3rd party deps
 	tiles3Version        = "3.0.8"
-	tomcatVersion        = "8.5.40"
+	tomcatVersion        = "8.5.42"
 	undertowVersion      = "1.4.27.Final"
 
 	gradleScriptDir = "${rootProject.projectDir}/gradle"
diff --git a/spring-test/spring-test.gradle b/spring-test/spring-test.gradle
index 95fa19eed65..76c6d57e0d6 100644
--- a/spring-test/spring-test.gradle
+++ b/spring-test/spring-test.gradle
@@ -71,7 +71,7 @@ dependencies {
 	testCompile("org.apache.tiles:tiles-core:${tiles3Version}", withoutJclOverSlf4J)
 	testCompile("org.apache.tiles:tiles-servlet:${tiles3Version}", withoutJclOverSlf4J)
 	testCompile("org.hsqldb:hsqldb:${hsqldbVersion}")
-	testCompile("org.apache.httpcomponents:httpclient:4.5.8") {
+	testCompile("org.apache.httpcomponents:httpclient:4.5.9") {
 		exclude group: "commons-logging", module: "commons-logging"
 	}
 	testCompile("io.projectreactor.ipc:reactor-netty")
diff --git a/spring-web/spring-web.gradle b/spring-web/spring-web.gradle
index 221691e7098..8f8875588be 100644
--- a/spring-web/spring-web.gradle
+++ b/spring-web/spring-web.gradle
@@ -37,7 +37,7 @@ dependencies {
 		exclude group: "javax.servlet", module: "javax.servlet-api"
 	}
 	optional("com.squareup.okhttp3:okhttp:3.12.3")
-	optional("org.apache.httpcomponents:httpclient:4.5.8") {
+	optional("org.apache.httpcomponents:httpclient:4.5.9") {
 		exclude group: "commons-logging", module: "commons-logging"
 	}
 	optional("org.apache.httpcomponents:httpasyncclient:4.1.4") {
diff --git a/spring-webflux/spring-webflux.gradle b/spring-webflux/spring-webflux.gradle
index 164cfc4cfd8..8abaa18f11e 100644
--- a/spring-webflux/spring-webflux.gradle
+++ b/spring-webflux/spring-webflux.gradle
@@ -33,7 +33,7 @@ dependencies {
 	optional("io.undertow:undertow-websockets-jsr:${undertowVersion}") {
 		exclude group: "org.jboss.spec.javax.websocket", module: "jboss-websocket-api_1.1_spec"
 	}
-	optional("org.apache.httpcomponents:httpclient:4.5.8") {
+	optional("org.apache.httpcomponents:httpclient:4.5.9") {
 		exclude group: "commons-logging", module: "commons-logging"
 	}
 	optional("org.jetbrains.kotlin:kotlin-reflect:${kotlinVersion}")
diff --git a/spring-webmvc/spring-webmvc.gradle b/spring-webmvc/spring-webmvc.gradle
index 5056645e65e..9c348b726e3 100644
--- a/spring-webmvc/spring-webmvc.gradle
+++ b/spring-webmvc/spring-webmvc.gradle
@@ -49,7 +49,7 @@ dependencies {
 	testCompile("org.eclipse.jetty:jetty-server:${jettyVersion}") {
 		exclude group: "javax.servlet", module: "javax.servlet"
 	}
-	testCompile("org.apache.httpcomponents:httpclient:4.5.8") {
+	testCompile("org.apache.httpcomponents:httpclient:4.5.9") {
 		exclude group: "commons-logging", module: "commons-logging"
 	}
 	testCompile("commons-fileupload:commons-fileupload:1.3.3")