diff --git a/Jarfile b/Jarfile
index a8a50b5c..a3f31bc4 100644
--- a/Jarfile
+++ b/Jarfile
@@ -19,6 +19,8 @@ jar 'org.apache.httpcomponents.client5:httpclient5', '5.6.2'
 
 # For managing Brotli input streams
 jar 'org.apache.commons:commons-compress', '1.27.1'
+# Pinned transitive of commons-compress to resolve CVE-2025-48924 (uncontrolled recursion)
+jar 'org.apache.commons:commons-lang3', '3.18.0'
 jar 'org.brotli:dec', '0.1.2'
 
 # for parsing HTML
diff --git a/Jars.lock b/Jars.lock
index 35cf7340..97bd60e1 100644
--- a/Jars.lock
+++ b/Jars.lock
@@ -19,7 +19,7 @@ org.apache.httpcomponents.core5:httpcore5:5.4.3:compile:
 org.apache.httpcomponents.core5:httpcore5-h2:5.4.3:compile:
 org.apache.commons:commons-compress:1.27.1:compile:
 commons-codec:commons-codec:1.17.1:compile:
-org.apache.commons:commons-lang3:3.16.0:compile:
+org.apache.commons:commons-lang3:3.18.0:compile:
 org.brotli:dec:0.1.2:compile:
 org.jsoup:jsoup:1.20.1:compile:
 org.slf4j:slf4j-nop:1.7.26:compile:
diff --git a/vendor/jars/org/apache/commons/commons-lang3/3.16.0/commons-lang3-3.16.0.jar b/vendor/jars/org/apache/commons/commons-lang3/3.16.0/commons-lang3-3.16.0.jar
deleted file mode 100644
index fca0ce0b..00000000
Binary files a/vendor/jars/org/apache/commons/commons-lang3/3.16.0/commons-lang3-3.16.0.jar and /dev/null differ
diff --git a/vendor/jars/org/apache/commons/commons-lang3/3.18.0/commons-lang3-3.18.0.jar b/vendor/jars/org/apache/commons/commons-lang3/3.18.0/commons-lang3-3.18.0.jar
new file mode 100644
index 00000000..9359e524
Binary files /dev/null and b/vendor/jars/org/apache/commons/commons-lang3/3.18.0/commons-lang3-3.18.0.jar differ