diff --git a/bom/pom.xml b/bom/pom.xml
index 29f77e1f7202..70f6da3c3741 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -188,7 +188,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-compress</artifactId>
-        <version>1.25.0</version>
+        <version>1.26.0</version>
       </dependency>
       <dependency>
         <groupId>org.codehaus.groovy</groupId>
diff --git a/core/pom.xml b/core/pom.xml
index 4280e9075da9..3d1f16532c01 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -276,6 +276,13 @@ THE SOFTWARE.
     <dependency>
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-compress</artifactId>
+      <exclusions>
+        <!-- Only needed for Pack200UnpackerAdapter, which we do not use -->
+        <exclusion>
+          <groupId>org.apache.commons</groupId>
+          <artifactId>commons-lang3</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.codehaus.groovy</groupId>