diff --git a/core/citrus-base/pom.xml b/core/citrus-base/pom.xml
index 0bf2221079..a7cadf742b 100644
--- a/core/citrus-base/pom.xml
+++ b/core/citrus-base/pom.xml
@@ -21,8 +21,8 @@
     </dependency>
 
     <dependency>
-      <groupId>commons-lang</groupId>
-      <artifactId>commons-lang</artifactId>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-lang3</artifactId>
     </dependency>
     <dependency>
       <groupId>commons-codec</groupId>
diff --git a/core/citrus-base/src/main/java/org/citrusframework/report/JUnitReporter.java b/core/citrus-base/src/main/java/org/citrusframework/report/JUnitReporter.java
index c69236f2e4..0530b68b33 100644
--- a/core/citrus-base/src/main/java/org/citrusframework/report/JUnitReporter.java
+++ b/core/citrus-base/src/main/java/org/citrusframework/report/JUnitReporter.java
@@ -16,6 +16,14 @@
 
 package org.citrusframework.report;
 
+import org.citrusframework.TestResult;
+import org.citrusframework.exceptions.CitrusRuntimeException;
+import org.citrusframework.util.FileUtils;
+import org.citrusframework.util.PropertyUtils;
+import org.citrusframework.util.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -30,14 +38,7 @@
 import java.util.Optional;
 import java.util.Properties;
 
-import org.citrusframework.TestResult;
-import org.citrusframework.exceptions.CitrusRuntimeException;
-import org.citrusframework.util.FileUtils;
-import org.citrusframework.util.PropertyUtils;
-import org.apache.commons.lang.StringEscapeUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.citrusframework.util.StringUtils;
+import static org.apache.commons.lang3.StringEscapeUtils.escapeXml;
 
 /**
  * @author Christoph Deppisch
@@ -112,12 +113,12 @@ private String createReportContent(String suiteName, List<TestResult> results, R
         for (TestResult result: results) {
             Properties detailProps = new Properties();
             detailProps.put("test.class", result.getClassName());
-            detailProps.put("test.name", StringEscapeUtils.escapeXml(result.getTestName()));
+            detailProps.put("test.name", escapeXml(result.getTestName()));
             detailProps.put("test.duration", "0.0");
 
             if (result.isFailed()) {
                 detailProps.put("test.error.cause", Optional.ofNullable(result.getCause()).map(Object::getClass).map(Class::getName).orElseGet(() -> Objects.toString(result.getFailureType(), "")));
-                detailProps.put("test.error.msg", StringEscapeUtils.escapeXml(result.getErrorMessage()));
+                detailProps.put("test.error.msg", escapeXml(result.getErrorMessage()));
                 detailProps.put("test.error.stackTrace", Optional.ofNullable(result.getCause()).map(cause -> {
                     StringWriter writer = new StringWriter();
                     cause.printStackTrace(new PrintWriter(writer));
diff --git a/core/citrus-base/src/test/java/org/citrusframework/variable/dictionary/AbstractDataDictionaryTest.java b/core/citrus-base/src/test/java/org/citrusframework/variable/dictionary/AbstractDataDictionaryTest.java
index deb21f9bc6..703b554854 100644
--- a/core/citrus-base/src/test/java/org/citrusframework/variable/dictionary/AbstractDataDictionaryTest.java
+++ b/core/citrus-base/src/test/java/org/citrusframework/variable/dictionary/AbstractDataDictionaryTest.java
@@ -1,6 +1,6 @@
 package org.citrusframework.variable.dictionary;
 
-import org.apache.commons.lang.NotImplementedException;
+import org.apache.commons.lang3.NotImplementedException;
 import org.apache.tools.ant.filters.StringInputStream;
 import org.citrusframework.context.TestContext;
 import org.citrusframework.exceptions.CitrusRuntimeException;
diff --git a/endpoints/citrus-mail/src/main/java/org/citrusframework/mail/message/MailMessageConverter.java b/endpoints/citrus-mail/src/main/java/org/citrusframework/mail/message/MailMessageConverter.java
index 379a46bc69..e173d60930 100644
--- a/endpoints/citrus-mail/src/main/java/org/citrusframework/mail/message/MailMessageConverter.java
+++ b/endpoints/citrus-mail/src/main/java/org/citrusframework/mail/message/MailMessageConverter.java
@@ -16,20 +16,6 @@
 
 package org.citrusframework.mail.message;
 
-import java.io.BufferedReader;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.StringReader;
-import java.nio.charset.Charset;
-import java.text.SimpleDateFormat;
-import java.util.Arrays;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Optional;
-import javax.xml.transform.Source;
-
 import jakarta.mail.MessagingException;
 import jakarta.mail.Multipart;
 import jakarta.mail.Session;
@@ -56,6 +42,20 @@
 import org.springframework.mail.javamail.MimeMailMessage;
 import org.springframework.mail.javamail.MimeMessageHelper;
 
+import javax.xml.transform.Source;
+import java.io.BufferedReader;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.StringReader;
+import java.nio.charset.Charset;
+import java.text.SimpleDateFormat;
+import java.util.Arrays;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Optional;
+
 /**
  * @author Christoph Deppisch
  * @author Christian Guggenmos
@@ -398,9 +398,9 @@ static String parseContentType(String contentType) throws IOException {
      */
     static String parseCharsetFromContentType(String contentType) {
         final String charsetPrefix = "charset=";
-        if (org.apache.commons.lang.StringUtils.contains(contentType, charsetPrefix)) {
-            String charsetName = org.apache.commons.lang.StringUtils.substringAfter(contentType, charsetPrefix);
-            return org.apache.commons.lang.StringUtils.substringBefore(charsetName, ";");
+        if (org.apache.commons.lang3.StringUtils.contains(contentType, charsetPrefix)) {
+            String charsetName = org.apache.commons.lang3.StringUtils.substringAfter(contentType, charsetPrefix);
+            return org.apache.commons.lang3.StringUtils.substringBefore(charsetName, ";");
         } else {
             return CitrusSettings.CITRUS_FILE_ENCODING;
         }
diff --git a/pom.xml b/pom.xml
index ed4c94b010..5b02299621 100644
--- a/pom.xml
+++ b/pom.xml
@@ -179,7 +179,7 @@
     <commons.cli.version>1.5.0</commons.cli.version>
     <commons.codec.version>1.16.0</commons.codec.version>
     <commons.io.version>2.14.0</commons.io.version>
-    <commons.lang.version>2.6</commons.lang.version>
+    <commons.lang.version>3.14.0</commons.lang.version>
     <commons.logging.version>1.2</commons.logging.version>
     <commons.net.version>3.10.0</commons.net.version>
     <cucumber.version>7.14.0</cucumber.version>
@@ -323,8 +323,8 @@
         <version>${commons.codec.version}</version>
       </dependency>
       <dependency>
-        <groupId>commons-lang</groupId>
-        <artifactId>commons-lang</artifactId>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-lang3</artifactId>
         <version>${commons.lang.version}</version>
       </dependency>
       <dependency>
diff --git a/validation/citrus-validation-xml/src/main/java/org/citrusframework/functions/core/EscapeXmlFunction.java b/validation/citrus-validation-xml/src/main/java/org/citrusframework/functions/core/EscapeXmlFunction.java
index e9e9e814e3..0767ee0194 100644
--- a/validation/citrus-validation-xml/src/main/java/org/citrusframework/functions/core/EscapeXmlFunction.java
+++ b/validation/citrus-validation-xml/src/main/java/org/citrusframework/functions/core/EscapeXmlFunction.java
@@ -16,12 +16,13 @@
 
 package org.citrusframework.functions.core;
 
-import java.util.List;
-
 import org.citrusframework.context.TestContext;
 import org.citrusframework.exceptions.InvalidFunctionUsageException;
 import org.citrusframework.functions.Function;
-import org.apache.commons.lang.StringEscapeUtils;
+
+import java.util.List;
+
+import static org.apache.commons.lang3.StringEscapeUtils.escapeXml;
 
 /**
  * Escapes XML fragment with escaped characters for '<', '>'.
@@ -36,7 +37,7 @@ public String execute(List<String> parameterList, TestContext context) {
             throw new InvalidFunctionUsageException("Invalid function parameter usage! Expected single parameter but found: " + parameterList.size());
         }
 
-        return StringEscapeUtils.escapeXml(parameterList.get(0));
+        return escapeXml(parameterList.get(0));
     }
 
 }