diff --git a/pom.xml b/pom.xml
index e07e9814..9ab265b9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -90,6 +90,18 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <dependency>
+                <!-- Spring Boot 2.2.6 doesn't update log4j yet, fixes CVE -->
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-api</artifactId>
+                <version>2.13.2</version>
+            </dependency>
+            <dependency>
+                <!-- Spring Boot 2.2.6 doesn't update log4j yet, fixes CVE -->
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-to-slf4j</artifactId>
+                <version>2.13.2</version>
+            </dependency>
             <dependency>
                 <groupId>org.liquibase</groupId>
                 <artifactId>liquibase-core</artifactId>