diff --git a/dist-material/release-docs/LICENSE b/dist-material/release-docs/LICENSE
index 6f634826c6..60d6a5924f 100644
--- a/dist-material/release-docs/LICENSE
+++ b/dist-material/release-docs/LICENSE
@@ -250,7 +250,7 @@ The text of each license is the standard Apache 2.0 license.
     https://mvnrepository.com/artifact/com.squareup.retrofit2/converter-jackson/2.9.0 Apache-2.0
     https://mvnrepository.com/artifact/com.squareup.retrofit2/retrofit/2.9.0 Apache-2.0
     https://mvnrepository.com/artifact/com.zaxxer/HikariCP/3.1.0 Apache-2.0
-    https://mvnrepository.com/artifact/commons-beanutils/commons-beanutils/1.9.4 Apache-2.0
+    https://mvnrepository.com/artifact/commons-beanutils/commons-beanutils/1.11.0 Apache-2.0
     https://mvnrepository.com/artifact/commons-codec/commons-codec/1.11 Apache-2.0
     https://mvnrepository.com/artifact/commons-io/commons-io/2.17.0 Apache-2.0
     https://mvnrepository.com/artifact/commons-net/commons-net/3.9.0 Apache-2.0
diff --git a/docs/en/changes/changes.md b/docs/en/changes/changes.md
index f8665bc3fb..bb41650abf 100644
--- a/docs/en/changes/changes.md
+++ b/docs/en/changes/changes.md
@@ -24,6 +24,7 @@
 * Enhance status APIs to support multiple `accept` header values, e.g. `Accept: application/json; charset=utf-8`.
 * Storage: separate `SpanAttachedEventRecord` for SkyWalking trace and Zipkin trace.
 * [Break Change]BanyanDB: Setup new Group policy. 
+* Bump up commons-beanutils to 1.11.0.
 
 #### UI
 
diff --git a/oap-server-bom/pom.xml b/oap-server-bom/pom.xml
index fc1ea0f655..5ab55640bd 100644
--- a/oap-server-bom/pom.xml
+++ b/oap-server-bom/pom.xml
@@ -62,7 +62,7 @@
         <vavr.version>0.10.3</vavr.version>
         <groovy.version>4.0.15</groovy.version>
         <mvel.version>2.4.8.Final</mvel.version>
-        <commons-beanutils.version>1.9.4</commons-beanutils.version>
+        <commons-beanutils.version>1.11.0</commons-beanutils.version>
         <flatbuffers-java.version>1.12.0</flatbuffers-java.version>
         <postgresql.version>42.4.4</postgresql.version>
         <jetcd.version>0.6.1</jetcd.version>