commons-code base64 decoding has vulnerability - this is 7 years old although its possible the team may fix it:

https://issues.apache.org/jira/browse/CODEC-134

Either we wait for commons-codec to fix and then httpclient to upgrade to use that fix, or we find a viable alternative for HttpClient.