diff --git a/pom.xml b/pom.xml
index 1e2800d..3bff6d3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -44,7 +44,8 @@
    </distributionManagement>
 
    <properties>
-      <thirdparty.commons-io.version>2.7</thirdparty.commons-io.version>
+      <thirdparty.bouncycastle.version>1.78.1</thirdparty.bouncycastle.version>
+      <thirdparty.commons-io.version>2.14.0</thirdparty.commons-io.version>
       <thirdparty.commons-lang3.version>3.4</thirdparty.commons-lang3.version>
       <thirdparty.guava.version>33.0.0-jre</thirdparty.guava.version>
       <thirdparty.hamcrest.version>1.3</thirdparty.hamcrest.version>
@@ -59,6 +60,13 @@
    </properties>
 
    <dependencies>
+     <!-- the version of bouncycastle in smbj is vulnerable     -->
+     <dependency>
+       <groupId>org.bouncycastle</groupId>
+       <artifactId>bcprov-jdk18on</artifactId>
+       <version>${thirdparty.bouncycastle.version}</version>
+       <scope>runtime</scope>
+     </dependency>
       <!-- 3rdparty dependencies. -->
       <dependency>
          <groupId>commons-io</groupId>