diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index 14751ab133..4c5e10925c 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -437,7 +437,16 @@
         <packageUrl regex="true">^pkg:maven/com\.networknt/json-schema-validator@.*$</packageUrl>
         <cve>CVE-2025-15104</cve>
     </suppress>
-
+    <!--
+    CVE-2026-54399 is scoped to Apache HttpComponents Core 5.x only. The classic httpcore 4.x line (org.apache.httpcomponents:httpcore) is EOL, is not listed as affected, and has no fixed 4.4.x release. False positive for the 4.x artifact.
+    -->
+    <suppress>
+        <notes><![CDATA[
+    file name: httpcore-4.4.16.jar (classic 4.x, not affected by the 5.x-scoped CVE)
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
+        <cve>CVE-2026-54399</cve>
+    </suppress>
     <!--
     CVE-2026-53914 is in the Kotlin compiler's build-cache deserialization. We don't compile Kotlin or use the Kotlin build
     cache; these jars are only transitive runtime dependencies of OkHttp (via the Duo SDK in mfa, and TCRdb). Not applicable.
@@ -449,5 +458,4 @@
         <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/.*@.*$</packageUrl>
         <cve>CVE-2026-53914</cve>
     </suppress>
-
 </suppressions>
diff --git a/gradle.properties b/gradle.properties
index aa3280faa4..c93286eea9 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -98,7 +98,7 @@ apacheDirectoryVersion=2.1.8
 apacheMinaVersion=2.2.9
 
 # Usually matches the version specified as a Spring Boot dependency (see springBootVersion below)
-apacheTomcatVersion=11.0.22
+apacheTomcatVersion=11.0.23
 
 # (mothership) -> json-path -> json-smart -> accessor-smart
 # (core) -> graalvm
@@ -195,9 +195,9 @@ httpcoreVersion=4.4.16
 intellijKotlinVersion=2.3.10
 
 # Update the three Jackson dependency versions below in tandem, unless one gets a patch release out-of-sync with the others
-jacksonVersion=2.21.4
-jacksonDatabindVersion=2.21.4
-jacksonJaxrsBaseVersion=2.21.4
+jacksonVersion=2.21.5
+jacksonDatabindVersion=2.21.5
+jacksonJaxrsBaseVersion=2.21.5
 
 # Note the inconsistent version numbering for "annotations"... it no longer matches the above
 jacksonAnnotationsVersion=2.21