diff --git a/CHANGES.md b/CHANGES.md
index b1b389db9..3a2ae95dc 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -36,7 +36,7 @@ Release Notes.
 * Upgrade zookeeper caused by CVE-2019-0201. 
 * Upgrade snake yaml caused by CVE-2017-18640.
 * Upgrade embed tomcat caused by CVE-2020-13935.
-
+* Upgrade commons-lang3 to avoid potential NPE in some JDK versions.
 
 #### UI
 
diff --git a/oap-server/pom.xml b/oap-server/pom.xml
index e659f5c8c..f4b8e0609 100755
--- a/oap-server/pom.xml
+++ b/oap-server/pom.xml
@@ -76,7 +76,7 @@
         <jackson-annotations.version>2.12.2</jackson-annotations.version>
         <jackson-databind.version>2.12.2</jackson-databind.version>
         <commons-codec.version>1.11</commons-codec.version>
-        <commons-lang3.version>3.7</commons-lang3.version>
+        <commons-lang3.version>3.12.0</commons-lang3.version>
         <commons-text.version>1.4</commons-text.version>
         <simpleclient.version>0.6.0</simpleclient.version>
         <apollo.version>1.8.0</apollo.version>
diff --git a/tools/dependencies/known-oap-backend-dependencies-es7.txt b/tools/dependencies/known-oap-backend-dependencies-es7.txt
index 9db7b2fd1..d41254128 100755
--- a/tools/dependencies/known-oap-backend-dependencies-es7.txt
+++ b/tools/dependencies/known-oap-backend-dependencies-es7.txt
@@ -21,7 +21,7 @@ commons-collections4-4.4.jar
 commons-compress-1.20.jar
 commons-dbcp-1.4.jar
 commons-io-2.6.jar
-commons-lang3-3.7.jar
+commons-lang3-3.12.0.jar
 commons-pool-1.5.4.jar
 commons-text-1.4.jar
 compiler-0.9.6.jar
diff --git a/tools/dependencies/known-oap-backend-dependencies.txt b/tools/dependencies/known-oap-backend-dependencies.txt
index db5c30773..a8b0cbfdf 100755
--- a/tools/dependencies/known-oap-backend-dependencies.txt
+++ b/tools/dependencies/known-oap-backend-dependencies.txt
@@ -21,7 +21,7 @@ commons-collections4-4.4.jar
 commons-compress-1.20.jar
 commons-dbcp-1.4.jar
 commons-io-2.6.jar
-commons-lang3-3.7.jar
+commons-lang3-3.12.0.jar
 commons-pool-1.5.4.jar
 commons-text-1.4.jar
 consul-client-1.4.2.jar