diff --git a/.build/parent-maven-pom.xml b/.build/parent-maven-pom.xml
index 8f56231bfc..bc0c2bd6aa 100644
--- a/.build/parent-maven-pom.xml
+++ b/.build/parent-maven-pom.xml
@@ -365,7 +365,7 @@
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-lang3</artifactId>
-        <version>3.13.0</version>
+        <version>3.18.0</version>
       </dependency>
       <dependency>
         <groupId>org.apache.commons</groupId>
diff --git a/CHANGES.txt b/CHANGES.txt
index f45d70e83c..d3ce50120c 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -299,6 +299,7 @@ Merged from 4.1:
  * Enforce CQL message size limit on multiframe messages (CASSANDRA-20052)
  * Fix race condition in DecayingEstimatedHistogramReservoir during rescale (CASSANDRA-19365)
 Merged from 4.0:
+ * Update commons-lang3 to 3.18.0 (CASSANDRA-20849)
  * Add NativeTransportMaxConcurrentConnectionsPerIp to StorageProxyMBean (CASSANDRA-20642)
  * Make secondary index implementations notified about rows in fully expired SSTables in compaction (CASSANDRA-20829)
  * Ensure prepared_statement INSERT timestamp precedes eviction DELETE (CASSANDRA-19703)