diff --git a/LICENSE-binary b/LICENSE-binary
index 8e348be..e77f2d0 100644
--- a/LICENSE-binary
+++ b/LICENSE-binary
@@ -220,7 +220,7 @@ See licenses-binary/ for text of these licenses.
 
 BSD 3-Clause
 ------------
-com.google.protobuf:protobuf-java:3.25.5
+com.google.protobuf:protobuf-java:3.25.8
 
 
 MIT License
diff --git a/pom.xml b/pom.xml
index 5e37822..75eddb4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -97,7 +97,7 @@
     <!--thirdparty dependency versions-->
     <shaded.prefix>org.apache.hadoop.thirdparty</shaded.prefix>
     <protobuf.shade.prefix>${shaded.prefix}.protobuf</protobuf.shade.prefix>
-    <protobuf_3.version>3.25.5</protobuf_3.version>
+    <protobuf_3.version>3.25.8</protobuf_3.version>
     <guava.version>33.4.8-jre</guava.version>
     <!-- previous versions of guava included this, but they've stopped it. We reinsert it to the shaded guava artifact-->
     <checkerframework.version>3.51.1</checkerframework.version>
diff --git a/src/site/markdown/index.md.vm b/src/site/markdown/index.md.vm
index 0b68b6d..4669322 100644
--- a/src/site/markdown/index.md.vm
+++ b/src/site/markdown/index.md.vm
@@ -42,7 +42,7 @@ This page provides an overview of the major changes.
 
 Protobuf-java
 -------------
-Google Protobuf's 3.25.5 jar is available as *org.apache.hadoop.thirdparty:hadoop-shaded-protobuf_3_25* artifact.
+Google Protobuf's 3.25.8 jar is available as *org.apache.hadoop.thirdparty:hadoop-shaded-protobuf_3_25* artifact.
 
 Following are relocations under *hadoop-shaded-protobuf_3_25* artifact: