diff --git a/logstash-core/build.gradle b/logstash-core/build.gradle
index 3275051d8..abad3e332 100644
--- a/logstash-core/build.gradle
+++ b/logstash-core/build.gradle
@@ -119,9 +119,9 @@ idea {
 }
 
 dependencies {
-    compile 'org.apache.logging.log4j:log4j-api:2.6.2'
-    compile 'org.apache.logging.log4j:log4j-core:2.6.2'
-    runtime 'org.apache.logging.log4j:log4j-slf4j-impl:2.6.2'
+    compile 'org.apache.logging.log4j:log4j-api:2.9.1'
+    compile 'org.apache.logging.log4j:log4j-core:2.9.1'
+    runtime 'org.apache.logging.log4j:log4j-slf4j-impl:2.9.1'
     // Jackson version moved to versions.yml in the project root (the JrJackson version is there too)
     compile "com.fasterxml.jackson.core:jackson-core:${jacksonVersion}"
     compile "com.fasterxml.jackson.core:jackson-databind:${jacksonVersion}"
diff --git a/logstash-core/gemspec_jars.rb b/logstash-core/gemspec_jars.rb
index 6c07c124f..857e8f648 100644
--- a/logstash-core/gemspec_jars.rb
+++ b/logstash-core/gemspec_jars.rb
@@ -2,9 +2,9 @@
 # runtime dependencies to generate this gemspec dependencies file to be eval'ed by the gemspec
 # for the jar-dependencies requirements.
 
-gem.requirements << "jar org.apache.logging.log4j:log4j-slf4j-impl, 2.6.2"
-gem.requirements << "jar org.apache.logging.log4j:log4j-api, 2.6.2"
-gem.requirements << "jar org.apache.logging.log4j:log4j-core, 2.6.2"
+gem.requirements << "jar org.apache.logging.log4j:log4j-slf4j-impl, 2.9.1"
+gem.requirements << "jar org.apache.logging.log4j:log4j-api, 2.9.1"
+gem.requirements << "jar org.apache.logging.log4j:log4j-core, 2.9.1"
 gem.requirements << "jar com.fasterxml.jackson.core:jackson-core, 2.9.1"
 gem.requirements << "jar com.fasterxml.jackson.core:jackson-databind, 2.9.1"
 gem.requirements << "jar com.fasterxml.jackson.core:jackson-annotations, 2.9.1"
diff --git a/logstash-core/lib/logstash-core_jars.rb b/logstash-core/lib/logstash-core_jars.rb
index c4d2f5ef4..8802ba2b8 100644
--- a/logstash-core/lib/logstash-core_jars.rb
+++ b/logstash-core/lib/logstash-core_jars.rb
@@ -2,27 +2,27 @@
 begin
   require 'jar_dependencies'
 rescue LoadError
-  require 'org/apache/logging/log4j/log4j-core/2.6.2/log4j-core-2.6.2.jar'
+  require 'org/slf4j/slf4j-api/1.7.25/slf4j-api-1.7.25.jar'
   require 'com/fasterxml/jackson/core/jackson-databind/2.9.1/jackson-databind-2.9.1.jar'
-  require 'org/apache/logging/log4j/log4j-api/2.6.2/log4j-api-2.6.2.jar'
-  require 'org/slf4j/slf4j-api/1.7.21/slf4j-api-1.7.21.jar'
   require 'com/fasterxml/jackson/core/jackson-annotations/2.9.1/jackson-annotations-2.9.1.jar'
-  require 'org/apache/logging/log4j/log4j-slf4j-impl/2.6.2/log4j-slf4j-impl-2.6.2.jar'
+  require 'org/apache/logging/log4j/log4j-api/2.9.1/log4j-api-2.9.1.jar'
+  require 'org/apache/logging/log4j/log4j-core/2.9.1/log4j-core-2.9.1.jar'
   require 'com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.9.1/jackson-dataformat-cbor-2.9.1.jar'
   require 'org/codehaus/janino/commons-compiler/3.0.7/commons-compiler-3.0.7.jar'
+  require 'org/apache/logging/log4j/log4j-slf4j-impl/2.9.1/log4j-slf4j-impl-2.9.1.jar'
   require 'com/fasterxml/jackson/core/jackson-core/2.9.1/jackson-core-2.9.1.jar'
   require 'org/codehaus/janino/janino/3.0.7/janino-3.0.7.jar'
 end
 
 if defined? Jars
-  require_jar( 'org.apache.logging.log4j', 'log4j-core', '2.6.2' )
+  require_jar( 'org.slf4j', 'slf4j-api', '1.7.25' )
   require_jar( 'com.fasterxml.jackson.core', 'jackson-databind', '2.9.1' )
-  require_jar( 'org.apache.logging.log4j', 'log4j-api', '2.6.2' )
-  require_jar( 'org.slf4j', 'slf4j-api', '1.7.21' )
   require_jar( 'com.fasterxml.jackson.core', 'jackson-annotations', '2.9.1' )
-  require_jar( 'org.apache.logging.log4j', 'log4j-slf4j-impl', '2.6.2' )
+  require_jar( 'org.apache.logging.log4j', 'log4j-api', '2.9.1' )
+  require_jar( 'org.apache.logging.log4j', 'log4j-core', '2.9.1' )
   require_jar( 'com.fasterxml.jackson.dataformat', 'jackson-dataformat-cbor', '2.9.1' )
   require_jar( 'org.codehaus.janino', 'commons-compiler', '3.0.7' )
+  require_jar( 'org.apache.logging.log4j', 'log4j-slf4j-impl', '2.9.1' )
   require_jar( 'com.fasterxml.jackson.core', 'jackson-core', '2.9.1' )
   require_jar( 'org.codehaus.janino', 'janino', '3.0.7' )
 end