diff --git a/CHANGELOG.md b/CHANGELOG.md
index b7f3e499d38ec..3fac9fd02a090 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -77,6 +77,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `org.jruby.jcodings:jcodings` from 1.0.58 to 1.0.61 ([#17061](https://github.com/opensearch-project/OpenSearch/pull/17061))
 - Bump `dnsjava:dnsjava` from 3.6.2 to 3.6.3 ([#17231](https://github.com/opensearch-project/OpenSearch/pull/17231))
 - Bump `com.google.code.gson:gson` from 2.11.0 to 2.12.1 ([#17229](https://github.com/opensearch-project/OpenSearch/pull/17229))
+- Bump `org.jruby.joni:joni` from 2.2.1 to 2.2.3 ([#17136](https://github.com/opensearch-project/OpenSearch/pull/17136))
 
 ### Changed
 - Indexed IP field supports `terms_query` with more than 1025 IP masks [#16391](https://github.com/opensearch-project/OpenSearch/pull/16391)
diff --git a/libs/grok/build.gradle b/libs/grok/build.gradle
index 5064c904b4273..9ea59bc2a77b8 100644
--- a/libs/grok/build.gradle
+++ b/libs/grok/build.gradle
@@ -29,7 +29,7 @@
  */
 
 dependencies {
-  api 'org.jruby.joni:joni:2.2.1'
+  api 'org.jruby.joni:joni:2.2.3'
   // joni dependencies:
   api 'org.jruby.jcodings:jcodings:1.0.61'
 
diff --git a/libs/grok/licenses/joni-2.2.1.jar.sha1 b/libs/grok/licenses/joni-2.2.1.jar.sha1
deleted file mode 100644
index d0338540f5512..0000000000000
--- a/libs/grok/licenses/joni-2.2.1.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-23d2f2eff7fa0cda465d86ec9d8bab53e496d9e6
\ No newline at end of file
diff --git a/libs/grok/licenses/joni-2.2.3.jar.sha1 b/libs/grok/licenses/joni-2.2.3.jar.sha1
new file mode 100644
index 0000000000000..fcc7a23f0d5aa
--- /dev/null
+++ b/libs/grok/licenses/joni-2.2.3.jar.sha1
@@ -0,0 +1 @@
+a26324720f0053e151c01fe4f407d0a84bafb2dc
\ No newline at end of file