diff --git a/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml b/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml
index 0a042cd4e1f3..94749f888c4d 100644
--- a/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml
+++ b/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml
@@ -44,6 +44,18 @@
                 <artifactId>commons-beanutils</artifactId>
                 <version>${commons.beanutils.version}</version>
             </dependency>
+            <dependency>
+                <!-- Bumped for security purposes (CVE-2025-48924); aligns bundled version with NOTICE -->
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-lang3</artifactId>
+                <version>3.18.0</version>
+            </dependency>
+            <dependency>
+                <!-- Bumped for security purposes; aligns bundled version with NOTICE -->
+                <groupId>org.xerial.snappy</groupId>
+                <artifactId>snappy-java</artifactId>
+                <version>${snappy.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
diff --git a/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE b/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE
index ba61822fd8e9..814ba28142d5 100644
--- a/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE
+++ b/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE
@@ -20,7 +20,7 @@ This project bundles the following dependencies under the Apache Software Licens
 - commons-logging:commons-logging:1.1.3
 - org.apache.commons:commons-compress:1.21
 - org.apache.commons:commons-configuration2:2.1.1
-- org.apache.commons:commons-lang3:3.12.0
+- org.apache.commons:commons-lang3:3.18.0
 - org.apache.commons:commons-text:1.4
 - org.apache.hadoop.thirdparty:hadoop-shaded-guava:1.4.0
 - org.apache.hadoop.thirdparty:hadoop-shaded-protobuf_3_25:1.4.0