diff --git a/CHANGELOG.md b/CHANGELOG.md
index 04956d3fe25f4..de8e87d85402b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -78,6 +78,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `com.nimbusds:nimbus-jose-jwt` from 10.7 to 10.8 ([#20715](https://github.com/opensearch-project/OpenSearch/pull/20715))
 - Bump OpenTelemetry to 1.59.0 and OpenTelemetry Semconv to 1.40.0 ([#20737](https://github.com/opensearch-project/OpenSearch/pull/20737))
 - Bump `actions/upload-artifact` from 6 to 7 ([#20762](https://github.com/opensearch-project/OpenSearch/pull/20762))
+- Bump `org.tukaani:xz` from 1.11 to 1.12 ([#20760](https://github.com/opensearch-project/OpenSearch/pull/20760))
 
 ### Removed
 
diff --git a/plugins/ingest-attachment/build.gradle b/plugins/ingest-attachment/build.gradle
index 24d4df8f3fdc1..f2c48c9b5b4dd 100644
--- a/plugins/ingest-attachment/build.gradle
+++ b/plugins/ingest-attachment/build.gradle
@@ -66,7 +66,7 @@ dependencies {
   runtimeOnly "com.optimaize.languagedetector:language-detector:0.6"
   runtimeOnly "com.google.guava:guava:${versions.guava}"
   // Other dependencies
-  api 'org.tukaani:xz:1.11'
+  api 'org.tukaani:xz:1.12'
   api "commons-io:commons-io:${versions.commonsio}"
   api "org.slf4j:slf4j-api:${versions.slf4j}"
 
diff --git a/plugins/ingest-attachment/licenses/xz-1.11.jar.sha1 b/plugins/ingest-attachment/licenses/xz-1.11.jar.sha1
deleted file mode 100644
index 0b9a0d252baf4..0000000000000
--- a/plugins/ingest-attachment/licenses/xz-1.11.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-bdfd1774efb216f506f4f3c5b08c205b308c50aa
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/xz-1.12.jar.sha1 b/plugins/ingest-attachment/licenses/xz-1.12.jar.sha1
new file mode 100644
index 0000000000000..bc01b2e8d10c4
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/xz-1.12.jar.sha1
@@ -0,0 +1 @@
+bb9703ba3753ab8665f65e6a25b3ddc7b09b1caf
\ No newline at end of file