diff --git a/build.xml b/build.xml
index f81c89d0f6..007c15c110 100644
--- a/build.xml
+++ b/build.xml
@@ -295,7 +295,7 @@ under the License.
     <dependency prefix="main.antlauncher" artifact="org.apache.ant:ant-launcher:1.10.14" usage="excelant"/>
 
     <!-- xml signature libs - not part of the distribution -->
-    <dependency prefix="dsig.xmlsec" artifact="org.apache.santuario:xmlsec:3.0.2" usage="ooxml-provided"/>
+    <dependency prefix="dsig.xmlsec" artifact="org.apache.santuario:xmlsec:3.0.3" usage="ooxml-provided"/>
     <dependency prefix="dsig.bouncycastle-prov" artifact="org.bouncycastle:bcprov-jdk18on:1.76" usage="ooxml-provided"/>
     <dependency prefix="dsig.bouncycastle-pkix" artifact="org.bouncycastle:bcpkix-jdk18on:1.76" usage="ooxml-provided"/>
     <dependency prefix="dsig.bouncycastle-util" artifact="org.bouncycastle:bcutil-jdk18on:1.76" usage="ooxml-provided"/>
diff --git a/osgi/README.md b/osgi/README.md
index 9b46dcf726..14e51e2ed9 100644
--- a/osgi/README.md
+++ b/osgi/README.md
@@ -25,7 +25,7 @@ Available in Maven Central (but version might be too old): https://mvnrepository
 3. Apache XML Security for Java, Bouncy Castle and XML Commons Resolver 
 These are required to sign or validate signed Office documents. The OSGi bundles are available in Maven Central:
 
-    - Apache XML Security for Java: https://mvnrepository.com/artifact/org.apache.santuario/xmlsec/3.0.2 (use v3.0.2 with POI v5.2.3)
+    - Apache XML Security for Java: https://mvnrepository.com/artifact/org.apache.santuario/xmlsec/3.0.3
     
     - XML Commons Resolver: https://mvnrepository.com/artifact/xml-resolver/xml-resolver/1.2-osgi
     
diff --git a/poi-ooxml/build.gradle b/poi-ooxml/build.gradle
index 9b4bd4a09c..0211ccdf22 100644
--- a/poi-ooxml/build.gradle
+++ b/poi-ooxml/build.gradle
@@ -66,11 +66,11 @@ dependencies {
     api "org.apache.logging.log4j:log4j-api:${log4jVersion}"
     api 'org.apache.commons:commons-collections4:4.4'
 
-    signingImplementation 'org.apache.santuario:xmlsec:3.0.2'
+    signingImplementation 'org.apache.santuario:xmlsec:3.0.3'
     signingImplementation "org.bouncycastle:bcpkix-jdk18on:${bouncyCastleVersion}"
     signingImplementation "org.bouncycastle:bcutil-jdk18on:${bouncyCastleVersion}"
 
-    rendersignImplementation 'org.apache.santuario:xmlsec:3.0.2'
+    rendersignImplementation 'org.apache.santuario:xmlsec:3.0.3'
     rendersignImplementation "org.bouncycastle:bcpkix-jdk18on:${bouncyCastleVersion}"
     rendersignImplementation "org.bouncycastle:bcutil-jdk18on:${bouncyCastleVersion}"
 
diff --git a/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java b/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
index b513c15ef9..88938a93b8 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
@@ -154,8 +154,8 @@ import org.w3c.dom.events.MutationEvent;
  * in the classpath:</p>
  * <ul>
  * <li>BouncyCastle bcpkix and bcprov (tested against 1.76)</li>
- * <li>Apache Santuario "xmlsec" (tested against 3.0.2)</li>
- * <li>and log4j-api (tested against 2.20.x)</li>
+ * <li>Apache Santuario "xmlsec" (tested against 4.0.0)</li>
+ * <li>and log4j-api (tested against 2.21.x)</li>
  * </ul>
  */
 public class SignatureInfo {