diff --git a/versions.lock b/versions.lock
index 992012c2e..cad4392cc 100644
--- a/versions.lock
+++ b/versions.lock
@@ -34,7 +34,7 @@ com.google.testing.compile:compile-testing:0.19 (1 constraints: de04f630)
 com.google.truth:truth:1.1 (1 constraints: b71111d7)
 com.squareup.okhttp3:okhttp:4.0.0 (1 constraints: 0605ff35)
 com.squareup.okio:okio:2.2.2 (1 constraints: 500c29fd)
-io.undertow:undertow-core:2.3.7.Final (1 constraints: 2607e75a)
+io.undertow:undertow-core:2.3.6.Final (1 constraints: 2507e05a)
 junit:junit:4.13.1 (2 constraints: dc1cc51a)
 net.bytebuddy:byte-buddy-agent:1.14.5 (1 constraints: 450b43de)
 net.jqwik:jqwik:1.7.3 (1 constraints: 0d050836)
diff --git a/versions.props b/versions.props
index 36146dcbb..6998b476d 100644
--- a/versions.props
+++ b/versions.props
@@ -14,7 +14,7 @@ com.squareup:javapoet = 1.13.0
 com.squareup.okhttp3:* = 4.0.0
 # Keep major.minor metrics version in sync with Apache Spark
 io.dropwizard.metrics:* = 4.2.19
-io.undertow:* = 2.3.7.Final
+io.undertow:* = 2.3.6.Final
 net.bytebuddy:* = 1.14.5
 net.jqwik:* = 1.7.3
 org.assertj:* = 3.24.2