diff --git a/CHANGELOG.md b/CHANGELOG.md
index 76d9a778b..123ff7d01 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,3 +2,4 @@
 ---
 
 - [Feature: Add config change listener feature support](https://github.com/Tencent/spring-cloud-tencent/pull/254)
+- [Upgrade: fix third-party lib CVEs & upgrade core spring libs version](https://github.com/Tencent/spring-cloud-tencent/pull/258)
diff --git a/pom.xml b/pom.xml
index a5613405b..214879889 100644
--- a/pom.xml
+++ b/pom.xml
@@ -91,6 +91,9 @@
 		<!-- Spring Cloud -->
 		<spring.cloud.version>2020.0.5</spring.cloud.version>
 
+		<!-- Spring Framework -->
+		<spring.framework.version>5.3.21</spring.framework.version>
+
 		<!-- Maven Plugin Versions -->
 		<jacoco.version>0.8.3</jacoco.version>
 		<maven-source-plugin.version>3.2.0</maven-source-plugin.version>
@@ -123,6 +126,15 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
+
+			<!-- Spring Framework Dependencies -->
+			<dependency>
+				<groupId>org.springframework</groupId>
+				<artifactId>spring-framework-bom</artifactId>
+				<version>${spring.framework.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/spring-cloud-tencent-commons/pom.xml b/spring-cloud-tencent-commons/pom.xml
index 29398bbbc..e8de59272 100644
--- a/spring-cloud-tencent-commons/pom.xml
+++ b/spring-cloud-tencent-commons/pom.xml
@@ -14,9 +14,8 @@
 	<name>Spring Cloud Tencent Commons</name>
 
 	<properties>
-		<commons.collections.version>3.2.2</commons.collections.version>
-		<commons.lang.version>2.5</commons.lang.version>
-		<commons.io.version>2.7</commons.io.version>
+		<commons.lang.version>2.6</commons.lang.version>
+		<commons.io.version>2.11.0</commons.io.version>
 	</properties>
 
 	<dependencies>
@@ -47,12 +46,6 @@
 			<artifactId>spring-cloud-starter</artifactId>
 		</dependency>
 
-		<dependency>
-			<groupId>commons-collections</groupId>
-			<artifactId>commons-collections</artifactId>
-			<version>${commons.collections.version}</version>
-		</dependency>
-
 		<dependency>
 			<groupId>commons-lang</groupId>
 			<artifactId>commons-lang</artifactId>
diff --git a/spring-cloud-tencent-dependencies/pom.xml b/spring-cloud-tencent-dependencies/pom.xml
index 793b89ade..46a35f9c7 100644
--- a/spring-cloud-tencent-dependencies/pom.xml
+++ b/spring-cloud-tencent-dependencies/pom.xml
@@ -71,10 +71,16 @@
 
 	<properties>
 		<revision>1.6.0-2020.0.5</revision>
+
+		<!-- Dependencies -->
 		<polaris.version>1.6.1</polaris.version>
-		<logback.version>1.2.7</logback.version>
+		<logback.version>1.2.11</logback.version>
 		<mocktio.version>4.5.1</mocktio.version>
 		<byte-buddy.version>1.12.10</byte-buddy.version>
+		<jackson.version>2.12.7</jackson.version>
+		<protobuf-java.version>3.16.1</protobuf-java.version>
+		<bcprov-jdk15on.version>1.69</bcprov-jdk15on.version>
+		<guava.version>31.0.1-jre</guava.version>
 
 		<!-- Maven Plugin Versions -->
 		<maven-source-plugin.version>3.2.0</maven-source-plugin.version>
@@ -147,12 +153,69 @@
 				<version>${revision}</version>
 			</dependency>
 
+			<!-- third part framework dependencies -->
+			<dependency>
+				<groupId>com.google.guava</groupId>
+				<artifactId>guava</artifactId>
+				<version>${guava.version}</version>
+				<exclusions>
+					<exclusion>
+						<artifactId>jsr305</artifactId>
+						<groupId>com.google.code.findbugs</groupId>
+					</exclusion>
+					<exclusion>
+						<artifactId>animal-sniffer-annotations</artifactId>
+						<groupId>org.codehaus.mojo</groupId>
+					</exclusion>
+					<exclusion>
+						<artifactId>error_prone_annotations</artifactId>
+						<groupId>com.google.errorprone</groupId>
+					</exclusion>
+				</exclusions>
+			</dependency>
+
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
+
 			<dependency>
 				<groupId>ch.qos.logback</groupId>
 				<artifactId>logback-classic</artifactId>
 				<version>${logback.version}</version>
 			</dependency>
 
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-annotations</artifactId>
+				<version>${jackson.version}</version>
+			</dependency>
+
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-core</artifactId>
+				<version>${jackson.version}</version>
+			</dependency>
+
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>${jackson.version}</version>
+			</dependency>
+
+			<dependency>
+				<groupId>com.google.protobuf</groupId>
+				<artifactId>protobuf-java</artifactId>
+				<version>${protobuf-java.version}</version>
+			</dependency>
+
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk15on</artifactId>
+				<version>${bcprov-jdk15on.version}</version>
+			</dependency>
+
 			<dependency>
 				<groupId>org.mockito</groupId>
 				<artifactId>mockito-inline</artifactId>
diff --git a/spring-cloud-tencent-polaris-loadbalancer/src/main/java/com/tencent/cloud/polaris/loadbalancer/LoadBalancerUtils.java b/spring-cloud-tencent-polaris-loadbalancer/src/main/java/com/tencent/cloud/polaris/loadbalancer/LoadBalancerUtils.java
index 33f67d2b1..0a6816ba0 100644
--- a/spring-cloud-tencent-polaris-loadbalancer/src/main/java/com/tencent/cloud/polaris/loadbalancer/LoadBalancerUtils.java
+++ b/spring-cloud-tencent-polaris-loadbalancer/src/main/java/com/tencent/cloud/polaris/loadbalancer/LoadBalancerUtils.java
@@ -27,10 +27,10 @@ import com.tencent.polaris.api.pojo.DefaultServiceInstances;
 import com.tencent.polaris.api.pojo.Instance;
 import com.tencent.polaris.api.pojo.ServiceInstances;
 import com.tencent.polaris.api.pojo.ServiceKey;
-import org.apache.commons.collections.CollectionUtils;
 import reactor.core.publisher.Flux;
 
 import org.springframework.cloud.client.ServiceInstance;
+import org.springframework.util.CollectionUtils;
 
 /**
  * load balancer utils.
@@ -54,7 +54,7 @@ public class LoadBalancerUtils {
 		}).collect(Collectors.toList());
 
 		String serviceName = null;
-		if (CollectionUtils.isNotEmpty(instances)) {
+		if (!CollectionUtils.isEmpty(instances)) {
 			serviceName = instances.get(0).getService();
 		}