diff --git a/.build/parent-pom-template.xml b/.build/parent-pom-template.xml
index 551ca359a8..0faca9e88c 100644
--- a/.build/parent-pom-template.xml
+++ b/.build/parent-pom-template.xml
@@ -359,7 +359,7 @@
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-lang3</artifactId>
-        <version>3.13.0</version>
+        <version>3.18.0</version>
       </dependency>
       <dependency>
         <groupId>org.apache.commons</groupId>
diff --git a/CHANGES.txt b/CHANGES.txt
index 0da6b28920..480f04b513 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,6 +1,7 @@
 5.0.6
  * Sort SSTable TOC entries for determinism (CASSANDRA-20494)
 Merged from 4.0:
+ * Update commons-lang3 to 3.18.0 (CASSANDRA-20849)
  * Add NativeTransportMaxConcurrentConnectionsPerIp to StorageProxyMBean (CASSANDRA-20642)
  * Make secondary index implementations notified about rows in fully expired SSTables in compaction (CASSANDRA-20829)