diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index 29e63eff5bf3e..5da5444a6c9fc 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -274,7 +274,7 @@ The Apache Software License, Version 2.0
     - com.google.guava-failureaccess-1.0.3.jar
     - com.google.guava-listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
  * J2ObjC Annotations -- com.google.j2objc-j2objc-annotations-3.1.jar
- * Netty Reactive Streams -- com.typesafe.netty-netty-reactive-streams-2.0.6.jar
+ * Netty Reactive Streams -- com.typesafe.netty-netty-reactive-streams-2.0.19.jar
  * Swagger
     - io.swagger.core.v3-swagger-annotations-jakarta-2.2.53.jar
  * slog -- io.github.merlimat.slog-slog-0.10.0.jar
@@ -390,7 +390,7 @@ The Apache Software License, Version 2.0
  * AirCompressor
     - io.airlift-aircompressor-2.0.3.jar
  * AsyncHttpClient
-    - org.asynchttpclient-async-http-client-3.0.10.jar
+    - org.asynchttpclient-async-http-client-3.0.13.jar
  * Jetty
     - org.eclipse.jetty-jetty-alpn-client-12.1.12.jar
     - org.eclipse.jetty-jetty-alpn-conscrypt-server-12.1.12.jar
diff --git a/distribution/shell/src/assemble/LICENSE.bin.txt b/distribution/shell/src/assemble/LICENSE.bin.txt
index 83e734a803667..9ff91eb751dc8 100644
--- a/distribution/shell/src/assemble/LICENSE.bin.txt
+++ b/distribution/shell/src/assemble/LICENSE.bin.txt
@@ -333,7 +333,7 @@ The Apache Software License, Version 2.0
     - failureaccess-1.0.3.jar
     - listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
  * J2ObjC Annotations -- j2objc-annotations-3.1.jar
- * Netty Reactive Streams -- netty-reactive-streams-2.0.6.jar
+ * Netty Reactive Streams -- netty-reactive-streams-2.0.19.jar
  * Swagger -- swagger-annotations-jakarta-2.2.53.jar
  * DataSketches
     - datasketches-java-7.0.1.jar
@@ -404,7 +404,7 @@ The Apache Software License, Version 2.0
   * AirCompressor
      - aircompressor-2.0.3.jar
  * AsyncHttpClient
-    - async-http-client-3.0.10.jar
+    - async-http-client-3.0.13.jar
  * Jetty
     - jetty-alpn-client-12.1.12.jar
     - jetty-client-12.1.12.jar
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 385d3c0739317..81aeb932a5a16 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -82,7 +82,7 @@ snakeyaml = "2.6"
 # Vert.x
 vertx = "4.5.32"
 # Networking / HTTP
-asynchttpclient = "3.0.10"
+asynchttpclient = "3.0.13"
 conscrypt = "2.6.2"
 okhttp3 = "5.5.0"
 okio = "3.18.1"
@@ -136,7 +136,7 @@ java-semver = "0.10.2"
 # oshi is capped at 6.x: at 7.0.0 the oshi-core-java11 artifact became a pom-only
 # relocation stub pointing at com.github.oshi:oshi-core, which is a coordinate change
 oshi = "6.12.0"
-netty-reactive-streams = "2.0.6"
+netty-reactive-streams = "2.0.19"
 # 9.2.0+ is required for CronType.SPRING53 (Spring 5.3+ cron syntax)
 cron-utils = "9.2.1"
 failsafe = "3.3.2"