diff --git a/CHANGELOG.md b/CHANGELOG.md
index ad4f27f080d1b..46476617073e6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,6 +53,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `org.bouncycastle:bcmail-jdk15to18` to `org.bouncycastle:bcmail-jdk18on` version 1.77 ([#12317](https://github.com/opensearch-project/OpenSearch/pull/12317))
 - Bump `org.bouncycastle:bcpkix-jdk15to18` to `org.bouncycastle:bcpkix-jdk18on` version 1.77 ([#12317](https://github.com/opensearch-project/OpenSearch/pull/12317))
 - Bump Jackson version from 2.16.1 to 2.16.2 ([#12611](https://github.com/opensearch-project/OpenSearch/pull/12611))
+- Bump `org.apache.commons:commons-compress` from 1.24.0 to 1.26.0 ([#12604](https://github.com/opensearch-project/OpenSearch/pull/12604))
 
 ### Changed
 - [CCR] Add getHistoryOperationsFromTranslog method to fetch the history snapshot from translogs ([#3948](https://github.com/opensearch-project/OpenSearch/pull/3948))
diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle
index 0562ecc6ee61b..4c9fab99fef21 100644
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -102,8 +102,8 @@ dependencies {
 
   api localGroovy()
 
-  api 'commons-codec:commons-codec:1.16.0'
-  api 'org.apache.commons:commons-compress:1.25.0'
+  api "commons-codec:commons-codec:${props.getProperty('commonscodec')}"
+  api "org.apache.commons:commons-compress:${props.getProperty('commonscompress')}"
   api 'org.apache.ant:ant:1.10.14'
   api 'com.netflix.nebula:gradle-extra-configurations-plugin:10.0.0'
   api 'com.netflix.nebula:nebula-publishing-plugin:21.0.0'
diff --git a/buildSrc/version.properties b/buildSrc/version.properties
index fa3680bbafe9b..d70f89850de84 100644
--- a/buildSrc/version.properties
+++ b/buildSrc/version.properties
@@ -40,9 +40,9 @@ httpclient        = 4.5.14
 httpcore          = 4.4.16
 httpasyncclient   = 4.1.5
 commonslogging    = 1.2
-commonscodec      = 1.15
-commonslang       = 3.13.0
-commonscompress   = 1.24.0
+commonscodec      = 1.16.1
+commonslang       = 3.14.0
+commonscompress   = 1.26.0
 # plugin dependencies
 aws               = 2.20.55
 reactivestreams   = 1.0.4
diff --git a/client/rest/licenses/commons-codec-1.15.jar.sha1 b/client/rest/licenses/commons-codec-1.15.jar.sha1
deleted file mode 100644
index 62d99837b87e1..0000000000000
--- a/client/rest/licenses/commons-codec-1.15.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
\ No newline at end of file
diff --git a/client/rest/licenses/commons-codec-1.16.1.jar.sha1 b/client/rest/licenses/commons-codec-1.16.1.jar.sha1
new file mode 100644
index 0000000000000..6b8803089c6d7
--- /dev/null
+++ b/client/rest/licenses/commons-codec-1.16.1.jar.sha1
@@ -0,0 +1 @@
+47bd4d333fba53406f6c6c51884ddbca435c8862
\ No newline at end of file
diff --git a/client/sniffer/licenses/commons-codec-1.15.jar.sha1 b/client/sniffer/licenses/commons-codec-1.15.jar.sha1
deleted file mode 100644
index 62d99837b87e1..0000000000000
--- a/client/sniffer/licenses/commons-codec-1.15.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
\ No newline at end of file
diff --git a/client/sniffer/licenses/commons-codec-1.16.1.jar.sha1 b/client/sniffer/licenses/commons-codec-1.16.1.jar.sha1
new file mode 100644
index 0000000000000..6b8803089c6d7
--- /dev/null
+++ b/client/sniffer/licenses/commons-codec-1.16.1.jar.sha1
@@ -0,0 +1 @@
+47bd4d333fba53406f6c6c51884ddbca435c8862
\ No newline at end of file
diff --git a/distribution/tools/plugin-cli/build.gradle b/distribution/tools/plugin-cli/build.gradle
index f40fb1c4b0a9f..d532e66ae73e1 100644
--- a/distribution/tools/plugin-cli/build.gradle
+++ b/distribution/tools/plugin-cli/build.gradle
@@ -104,5 +104,22 @@ thirdPartyAudit.ignoreMissingClasses(
   'org.tukaani.xz.MemoryLimitException',
   'org.tukaani.xz.UnsupportedOptionsException',
   'org.tukaani.xz.XZ',
-  'org.tukaani.xz.XZOutputStream'
+  'org.tukaani.xz.XZOutputStream',
+  'org.apache.commons.codec.Charsets',
+  'org.apache.commons.codec.digest.PureJavaCrc32C',
+  'org.apache.commons.codec.digest.XXHash32',
+  'org.apache.commons.io.Charsets',
+  'org.apache.commons.io.FileUtils',
+  'org.apache.commons.io.FilenameUtils',
+  'org.apache.commons.io.IOUtils',
+  'org.apache.commons.io.build.AbstractOrigin',
+  'org.apache.commons.io.build.AbstractStreamBuilder',
+  'org.apache.commons.io.file.attribute.FileTimes',
+  'org.apache.commons.io.input.BoundedInputStream',
+  'org.apache.commons.io.input.CloseShieldInputStream',
+  'org.apache.commons.io.input.CountingInputStream',
+  'org.apache.commons.io.input.NullInputStream',
+  'org.apache.commons.io.output.CountingOutputStream',
+  'org.apache.commons.io.output.NullOutputStream',
+  'org.apache.commons.lang3.reflect.FieldUtils'
 )
diff --git a/distribution/tools/plugin-cli/licenses/commons-compress-1.24.0.jar.sha1 b/distribution/tools/plugin-cli/licenses/commons-compress-1.24.0.jar.sha1
deleted file mode 100644
index 23999d1bfbde4..0000000000000
--- a/distribution/tools/plugin-cli/licenses/commons-compress-1.24.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-b4b1b5a3d9573b2970fddab236102c0a4d27d35e
\ No newline at end of file
diff --git a/distribution/tools/plugin-cli/licenses/commons-compress-1.26.0.jar.sha1 b/distribution/tools/plugin-cli/licenses/commons-compress-1.26.0.jar.sha1
new file mode 100644
index 0000000000000..b423eef4498af
--- /dev/null
+++ b/distribution/tools/plugin-cli/licenses/commons-compress-1.26.0.jar.sha1
@@ -0,0 +1 @@
+659feffdd12280201c8aacb8f7be94f9a883c824
\ No newline at end of file
diff --git a/plugins/analysis-phonetic/licenses/commons-codec-1.15.jar.sha1 b/plugins/analysis-phonetic/licenses/commons-codec-1.15.jar.sha1
deleted file mode 100644
index 62d99837b87e1..0000000000000
--- a/plugins/analysis-phonetic/licenses/commons-codec-1.15.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
\ No newline at end of file
diff --git a/plugins/analysis-phonetic/licenses/commons-codec-1.16.1.jar.sha1 b/plugins/analysis-phonetic/licenses/commons-codec-1.16.1.jar.sha1
new file mode 100644
index 0000000000000..6b8803089c6d7
--- /dev/null
+++ b/plugins/analysis-phonetic/licenses/commons-codec-1.16.1.jar.sha1
@@ -0,0 +1 @@
+47bd4d333fba53406f6c6c51884ddbca435c8862
\ No newline at end of file
diff --git a/plugins/crypto-kms/licenses/commons-codec-1.15.jar.sha1 b/plugins/crypto-kms/licenses/commons-codec-1.15.jar.sha1
deleted file mode 100644
index 62d99837b87e1..0000000000000
--- a/plugins/crypto-kms/licenses/commons-codec-1.15.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
\ No newline at end of file
diff --git a/plugins/crypto-kms/licenses/commons-codec-1.16.1.jar.sha1 b/plugins/crypto-kms/licenses/commons-codec-1.16.1.jar.sha1
new file mode 100644
index 0000000000000..6b8803089c6d7
--- /dev/null
+++ b/plugins/crypto-kms/licenses/commons-codec-1.16.1.jar.sha1
@@ -0,0 +1 @@
+47bd4d333fba53406f6c6c51884ddbca435c8862
\ No newline at end of file
diff --git a/plugins/discovery-azure-classic/licenses/commons-codec-1.15.jar.sha1 b/plugins/discovery-azure-classic/licenses/commons-codec-1.15.jar.sha1
deleted file mode 100644
index 62d99837b87e1..0000000000000
--- a/plugins/discovery-azure-classic/licenses/commons-codec-1.15.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
\ No newline at end of file
diff --git a/plugins/discovery-azure-classic/licenses/commons-codec-1.16.1.jar.sha1 b/plugins/discovery-azure-classic/licenses/commons-codec-1.16.1.jar.sha1
new file mode 100644
index 0000000000000..6b8803089c6d7
--- /dev/null
+++ b/plugins/discovery-azure-classic/licenses/commons-codec-1.16.1.jar.sha1
@@ -0,0 +1 @@
+47bd4d333fba53406f6c6c51884ddbca435c8862
\ No newline at end of file
diff --git a/plugins/discovery-ec2/licenses/commons-codec-1.15.jar.sha1 b/plugins/discovery-ec2/licenses/commons-codec-1.15.jar.sha1
deleted file mode 100644
index 62d99837b87e1..0000000000000
--- a/plugins/discovery-ec2/licenses/commons-codec-1.15.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
\ No newline at end of file
diff --git a/plugins/discovery-ec2/licenses/commons-codec-1.16.1.jar.sha1 b/plugins/discovery-ec2/licenses/commons-codec-1.16.1.jar.sha1
new file mode 100644
index 0000000000000..6b8803089c6d7
--- /dev/null
+++ b/plugins/discovery-ec2/licenses/commons-codec-1.16.1.jar.sha1
@@ -0,0 +1 @@
+47bd4d333fba53406f6c6c51884ddbca435c8862
\ No newline at end of file
diff --git a/plugins/discovery-gce/licenses/commons-codec-1.15.jar.sha1 b/plugins/discovery-gce/licenses/commons-codec-1.15.jar.sha1
deleted file mode 100644
index 62d99837b87e1..0000000000000
--- a/plugins/discovery-gce/licenses/commons-codec-1.15.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
\ No newline at end of file
diff --git a/plugins/discovery-gce/licenses/commons-codec-1.16.1.jar.sha1 b/plugins/discovery-gce/licenses/commons-codec-1.16.1.jar.sha1
new file mode 100644
index 0000000000000..6b8803089c6d7
--- /dev/null
+++ b/plugins/discovery-gce/licenses/commons-codec-1.16.1.jar.sha1
@@ -0,0 +1 @@
+47bd4d333fba53406f6c6c51884ddbca435c8862
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/commons-codec-1.15.jar.sha1 b/plugins/ingest-attachment/licenses/commons-codec-1.15.jar.sha1
deleted file mode 100644
index 62d99837b87e1..0000000000000
--- a/plugins/ingest-attachment/licenses/commons-codec-1.15.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/commons-codec-1.16.1.jar.sha1 b/plugins/ingest-attachment/licenses/commons-codec-1.16.1.jar.sha1
new file mode 100644
index 0000000000000..6b8803089c6d7
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/commons-codec-1.16.1.jar.sha1
@@ -0,0 +1 @@
+47bd4d333fba53406f6c6c51884ddbca435c8862
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/commons-compress-1.24.0.jar.sha1 b/plugins/ingest-attachment/licenses/commons-compress-1.24.0.jar.sha1
deleted file mode 100644
index 23999d1bfbde4..0000000000000
--- a/plugins/ingest-attachment/licenses/commons-compress-1.24.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-b4b1b5a3d9573b2970fddab236102c0a4d27d35e
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/commons-compress-1.26.0.jar.sha1 b/plugins/ingest-attachment/licenses/commons-compress-1.26.0.jar.sha1
new file mode 100644
index 0000000000000..b423eef4498af
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/commons-compress-1.26.0.jar.sha1
@@ -0,0 +1 @@
+659feffdd12280201c8aacb8f7be94f9a883c824
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/commons-lang3-3.13.0.jar.sha1 b/plugins/ingest-attachment/licenses/commons-lang3-3.13.0.jar.sha1
deleted file mode 100644
index d0c2f2486ee1f..0000000000000
--- a/plugins/ingest-attachment/licenses/commons-lang3-3.13.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-b7263237aa89c1f99b327197c41d0669707a462e
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/commons-lang3-3.14.0.jar.sha1 b/plugins/ingest-attachment/licenses/commons-lang3-3.14.0.jar.sha1
new file mode 100644
index 0000000000000..d783e07e40902
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/commons-lang3-3.14.0.jar.sha1
@@ -0,0 +1 @@
+1ed471194b02f2c6cb734a0cd6f6f107c673afae
\ No newline at end of file
diff --git a/plugins/repository-azure/licenses/commons-lang3-3.13.0.jar.sha1 b/plugins/repository-azure/licenses/commons-lang3-3.13.0.jar.sha1
deleted file mode 100644
index d0c2f2486ee1f..0000000000000
--- a/plugins/repository-azure/licenses/commons-lang3-3.13.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-b7263237aa89c1f99b327197c41d0669707a462e
\ No newline at end of file
diff --git a/plugins/repository-azure/licenses/commons-lang3-3.14.0.jar.sha1 b/plugins/repository-azure/licenses/commons-lang3-3.14.0.jar.sha1
new file mode 100644
index 0000000000000..d783e07e40902
--- /dev/null
+++ b/plugins/repository-azure/licenses/commons-lang3-3.14.0.jar.sha1
@@ -0,0 +1 @@
+1ed471194b02f2c6cb734a0cd6f6f107c673afae
\ No newline at end of file
diff --git a/plugins/repository-gcs/licenses/commons-codec-1.15.jar.sha1 b/plugins/repository-gcs/licenses/commons-codec-1.15.jar.sha1
deleted file mode 100644
index 62d99837b87e1..0000000000000
--- a/plugins/repository-gcs/licenses/commons-codec-1.15.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
\ No newline at end of file
diff --git a/plugins/repository-gcs/licenses/commons-codec-1.16.1.jar.sha1 b/plugins/repository-gcs/licenses/commons-codec-1.16.1.jar.sha1
new file mode 100644
index 0000000000000..6b8803089c6d7
--- /dev/null
+++ b/plugins/repository-gcs/licenses/commons-codec-1.16.1.jar.sha1
@@ -0,0 +1 @@
+47bd4d333fba53406f6c6c51884ddbca435c8862
\ No newline at end of file
diff --git a/plugins/repository-hdfs/licenses/commons-codec-1.15.jar.sha1 b/plugins/repository-hdfs/licenses/commons-codec-1.15.jar.sha1
deleted file mode 100644
index 62d99837b87e1..0000000000000
--- a/plugins/repository-hdfs/licenses/commons-codec-1.15.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
\ No newline at end of file
diff --git a/plugins/repository-hdfs/licenses/commons-codec-1.16.1.jar.sha1 b/plugins/repository-hdfs/licenses/commons-codec-1.16.1.jar.sha1
new file mode 100644
index 0000000000000..6b8803089c6d7
--- /dev/null
+++ b/plugins/repository-hdfs/licenses/commons-codec-1.16.1.jar.sha1
@@ -0,0 +1 @@
+47bd4d333fba53406f6c6c51884ddbca435c8862
\ No newline at end of file
diff --git a/plugins/repository-hdfs/licenses/commons-compress-1.24.0.jar.sha1 b/plugins/repository-hdfs/licenses/commons-compress-1.24.0.jar.sha1
deleted file mode 100644
index 23999d1bfbde4..0000000000000
--- a/plugins/repository-hdfs/licenses/commons-compress-1.24.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-b4b1b5a3d9573b2970fddab236102c0a4d27d35e
\ No newline at end of file
diff --git a/plugins/repository-hdfs/licenses/commons-compress-1.26.0.jar.sha1 b/plugins/repository-hdfs/licenses/commons-compress-1.26.0.jar.sha1
new file mode 100644
index 0000000000000..b423eef4498af
--- /dev/null
+++ b/plugins/repository-hdfs/licenses/commons-compress-1.26.0.jar.sha1
@@ -0,0 +1 @@
+659feffdd12280201c8aacb8f7be94f9a883c824
\ No newline at end of file
diff --git a/plugins/repository-s3/licenses/commons-codec-1.15.jar.sha1 b/plugins/repository-s3/licenses/commons-codec-1.15.jar.sha1
deleted file mode 100644
index 62d99837b87e1..0000000000000
--- a/plugins/repository-s3/licenses/commons-codec-1.15.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
\ No newline at end of file
diff --git a/plugins/repository-s3/licenses/commons-codec-1.16.1.jar.sha1 b/plugins/repository-s3/licenses/commons-codec-1.16.1.jar.sha1
new file mode 100644
index 0000000000000..6b8803089c6d7
--- /dev/null
+++ b/plugins/repository-s3/licenses/commons-codec-1.16.1.jar.sha1
@@ -0,0 +1 @@
+47bd4d333fba53406f6c6c51884ddbca435c8862
\ No newline at end of file