diff --git a/CHANGELOG.md b/CHANGELOG.md
index cdd37de797bf7..5ebf54b3f53c7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -120,6 +120,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `com.google.cloud:google-cloud-storage` from 2.55.0 to 2.60.0 ([#20023](https://github.com/opensearch-project/OpenSearch/pull/20023))
 - Bump `commons-cli:commons-cli` from 1.10.0 to 1.11.0 ([#20022](https://github.com/opensearch-project/OpenSearch/pull/20022))
 - Bump `com.squareup.okio:okio` from 3.16.0 to 3.16.3 ([#20025](https://github.com/opensearch-project/OpenSearch/pull/20025))
+- Bump `org.tukaani:xz` from 1.10 to 1.11 ([#20082](https://github.com/opensearch-project/OpenSearch/pull/20082))
 - Bump `com.google.api:api-common` from 2.52.0 to 2.55.1 ([#20083](https://github.com/opensearch-project/OpenSearch/pull/20083))
 - Bump `actions/upload-artifact` from 4 to 5 ([#20081](https://github.com/opensearch-project/OpenSearch/pull/20081))
 
diff --git a/plugins/ingest-attachment/build.gradle b/plugins/ingest-attachment/build.gradle
index e7d6ca4dfdda8..f5c8e4c7a3643 100644
--- a/plugins/ingest-attachment/build.gradle
+++ b/plugins/ingest-attachment/build.gradle
@@ -66,7 +66,7 @@ dependencies {
   runtimeOnly "com.optimaize.languagedetector:language-detector:0.6"
   runtimeOnly "com.google.guava:guava:${versions.guava}"
   // Other dependencies
-  api 'org.tukaani:xz:1.10'
+  api 'org.tukaani:xz:1.11'
   api "commons-io:commons-io:${versions.commonsio}"
   api "org.slf4j:slf4j-api:${versions.slf4j}"
 
diff --git a/plugins/ingest-attachment/licenses/xz-1.10.jar.sha1 b/plugins/ingest-attachment/licenses/xz-1.10.jar.sha1
deleted file mode 100644
index e3757c19ce5ab..0000000000000
--- a/plugins/ingest-attachment/licenses/xz-1.10.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-1be8166f89e035a56c6bfc67dbc423996fe577e2
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/xz-1.11.jar.sha1 b/plugins/ingest-attachment/licenses/xz-1.11.jar.sha1
new file mode 100644
index 0000000000000..0b9a0d252baf4
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/xz-1.11.jar.sha1
@@ -0,0 +1 @@
+bdfd1774efb216f506f4f3c5b08c205b308c50aa
\ No newline at end of file