diff --git a/CHANGELOG.md b/CHANGELOG.md
index df8c1411b2cdf..3c40478dbe85a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -74,6 +74,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `com.netflix.nebula:nebula-publishing-plugin` from 20.3.0 to 21.0.0 ([#11671](https://github.com/opensearch-project/OpenSearch/pull/11671))
 - Bump `com.maxmind.geoip2:geoip2` from 4.1.0 to 4.2.0 ([#11559](https://github.com/opensearch-project/OpenSearch/pull/11559))
 - Bump `commons-cli:commons-cli` from 1.5.0 to 1.6.0 ([#10996](https://github.com/opensearch-project/OpenSearch/pull/10996))
+- Bump `org.apache.commons:commons-lang3` from 3.13.0 to 3.14.0 ([#11691](https://github.com/opensearch-project/OpenSearch/pull/11691))
 
 ### Changed
 - Force merge with `only_expunge_deletes` honors max segment size ([#10036](https://github.com/opensearch-project/OpenSearch/pull/10036))
diff --git a/plugins/repository-hdfs/build.gradle b/plugins/repository-hdfs/build.gradle
index f37715983ff30..e3a47bdfb4ff3 100644
--- a/plugins/repository-hdfs/build.gradle
+++ b/plugins/repository-hdfs/build.gradle
@@ -76,7 +76,7 @@ dependencies {
   api "org.apache.commons:commons-compress:${versions.commonscompress}"
   api 'org.apache.commons:commons-configuration2:2.8.0'
   api 'commons-io:commons-io:2.12.0'
-  api 'org.apache.commons:commons-lang3:3.13.0'
+  api 'org.apache.commons:commons-lang3:3.14.0'
   implementation 'com.google.re2j:re2j:1.6'
   api 'javax.servlet:servlet-api:2.5'
   api "org.slf4j:slf4j-api:${versions.slf4j}"
diff --git a/plugins/repository-hdfs/licenses/commons-lang3-3.13.0.jar.sha1 b/plugins/repository-hdfs/licenses/commons-lang3-3.13.0.jar.sha1
deleted file mode 100644
index d0c2f2486ee1f..0000000000000
--- a/plugins/repository-hdfs/licenses/commons-lang3-3.13.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-b7263237aa89c1f99b327197c41d0669707a462e
\ No newline at end of file
diff --git a/plugins/repository-hdfs/licenses/commons-lang3-3.14.0.jar.sha1 b/plugins/repository-hdfs/licenses/commons-lang3-3.14.0.jar.sha1
new file mode 100644
index 0000000000000..d783e07e40902
--- /dev/null
+++ b/plugins/repository-hdfs/licenses/commons-lang3-3.14.0.jar.sha1
@@ -0,0 +1 @@
+1ed471194b02f2c6cb734a0cd6f6f107c673afae
\ No newline at end of file