diff --git a/common/pom.xml b/common/pom.xml
index 802a15d0cd2..8da89b8d87d 100644
--- a/common/pom.xml
+++ b/common/pom.xml
@@ -35,9 +35,11 @@
 
   <dependencies>
     <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
-      <version>1.2.12</version>
+      <!-- Drop-in replacement for EOL log4j 1.x (keeps the org.apache.log4j
+           packages) without CVE-2019-17571 / CVE-2022-23302/23305/23307. -->
+      <groupId>ch.qos.reload4j</groupId>
+      <artifactId>reload4j</artifactId>
+      <version>1.2.25</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>
diff --git a/examples/spark/pom.xml b/examples/spark/pom.xml
index e4f771cef4f..57285ad2869 100644
--- a/examples/spark/pom.xml
+++ b/examples/spark/pom.xml
@@ -78,7 +78,7 @@
     <dependency>
     <groupId>com.fasterxml.jackson.core</groupId>
     <artifactId>jackson-databind</artifactId>
-    <version>${dep.jackson.version}</version>
+    <version>${dep.jackson.databind.version}</version>
     </dependency>
   </dependencies>
 
@@ -217,7 +217,8 @@
       <id>spark-3.1</id>
       <properties>
         <spark.binary.version>3.1</spark.binary.version>
-        <dep.jackson.version>2.10.0</dep.jackson.version>
+        <dep.jackson.version>2.10.5</dep.jackson.version>
+        <dep.jackson.databind.version>2.10.5.1</dep.jackson.databind.version>
       </properties>
     </profile>
   </profiles>
diff --git a/pom.xml b/pom.xml
index a9bfd39a9e1..c9d994446b8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -124,10 +124,10 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <maven.compiler.source>8</maven.compiler.source>
     <maven.compiler.target>8</maven.compiler.target>
-    <snappy.version>1.1.2.6</snappy.version>
+    <snappy.version>1.1.10.7</snappy.version>
     <hadoop.version>2.7.2</hadoop.version>
-    <httpclient.version>4.3.4</httpclient.version>
-    <httpcore.version>4.3-alpha1</httpcore.version>
+    <httpclient.version>4.5.14</httpclient.version>
+    <httpcore.version>4.4.16</httpcore.version>
     <scala.binary.version>2.12</scala.binary.version>
     <scala.version>2.12.10</scala.version>
     <hadoop.deps.scope>compile</hadoop.deps.scope>
@@ -138,7 +138,10 @@
     <scala.deps.scope>compile</scala.deps.scope>
     <dev.path>${basedir}/dev</dev.path>
     <spark.master.url>local[2]</spark.master.url>
-    <dep.jackson.version>2.6.5</dep.jackson.version>
+    <!-- Aligned with the jackson shipped by the default Spark (3.3.3) runtime.
+         2.6.5 carried multiple deserialization RCE CVEs (e.g. CVE-2017-7525). -->
+    <dep.jackson.version>2.13.4</dep.jackson.version>
+    <dep.jackson.databind.version>2.13.4.2</dep.jackson.databind.version>
     <hdfs.url>local</hdfs.url>
     <presto.jdbc.url>localhost:8086</presto.jdbc.url>
     <!--    prestosql by default-->
@@ -375,7 +378,7 @@
       <dependency>
         <groupId>junit</groupId>
         <artifactId>junit</artifactId>
-        <version>4.11</version>
+        <version>4.13.2</version>
         <scope>test</scope>
       </dependency>
       <dependency>
@@ -513,7 +516,7 @@
       <id>hadoop-2.8</id>
       <properties>
         <hadoop.version>2.8.3</hadoop.version>
-        <httpclient.version>4.5.2</httpclient.version>
+        <httpclient.version>4.5.14</httpclient.version>
       </properties>
     </profile>
     <profile>
@@ -671,7 +674,8 @@
         <spark.version>3.1.1</spark.version>
         <scala.binary.version>2.12</scala.binary.version>
         <scala.version>2.12.8</scala.version>
-        <dep.jackson.version>2.10.0</dep.jackson.version>
+        <dep.jackson.version>2.10.5</dep.jackson.version>
+        <dep.jackson.databind.version>2.10.5.1</dep.jackson.databind.version>
       </properties>
       <build>
         <plugins>
diff --git a/sdk/sdk/pom.xml b/sdk/sdk/pom.xml
index 7ac8974dd9d..df15e37d9ca 100644
--- a/sdk/sdk/pom.xml
+++ b/sdk/sdk/pom.xml
@@ -180,7 +180,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>${dep.jackson.version}</version>
+      <version>${dep.jackson.databind.version}</version>
       <exclusions>
         <exclusion>
           <groupId>ch.qos.logback</groupId>