diff --git a/project/Dependencies.scala b/project/Dependencies.scala
index 4b268520..b70ea19c 100644
--- a/project/Dependencies.scala
+++ b/project/Dependencies.scala
@@ -35,7 +35,7 @@ object Dependencies {
   lazy val jacksonDatabind =
     "com.fasterxml.jackson.core" % "jackson-databind" % "2.15.2"
   // XXX Version bundled with Spark is vulnerable to CVE-2022-3171
-  lazy val protobuf = "com.google.protobuf" % "protobuf-java" % "3.25.4"
+  lazy val protobuf = "com.google.protobuf" % "protobuf-java" % "4.28.0"
   // XXX Bundled version is vulnerable to CVE-2023-34455
   lazy val snappyJava = "org.xerial.snappy" % "snappy-java" % "1.1.10.5"
 }