# Apache Commons-codec module with vulnerability is being pulled in latest Keycloak admin client **URL:** https://forum.keycloak.org/t/apache-commons-codec-module-with-vulnerability-is-being-pulled-in-latest-keycloak-admin-client/14166 **Category:** Securing applications **Created:** [March 9, 2022, 2:31pm UTC](https://forum.keycloak.org/t/apache-commons-codec-module-with-vulnerability-is-being-pulled-in-latest-keycloak-admin-client/14166 "2022-03-09T14:31:37Z") **Posts on this page:** 1 **Page:** 1
### Author: ![paulbleeker](https://avatars.discourse-cdn.com/v4/letter/p/9fc348/32.png) [@paulbleeker](https://forum.keycloak.org/u/paulbleeker) #### Post date: [March 9, 2022, 2:31pm UTC](https://forum.keycloak.org/t/apache-commons-codec-module-with-vulnerability-is-being-pulled-in-latest-keycloak-admin-client/14166/1 "2022-03-09T14:31:37Z")
The latest version of the Keycloak admin client pulls version 1.13 of the Apache commons-codec instead of 1.15 that contains the vulnerability fix. Is there a work around? pom.xml: dependency\> org.keycloak keycloak-admin-client 13.0.0 org.keycloak:keycloak-admin-client:jar:13.0.0:compile [INFO] | ± org.keycloak:keycloak-core:jar:13.0.0:compile [INFO] | ± org.keycloak:keycloak-common:jar:13.0.0:compile [INFO] | ± org.jboss.resteasy:resteasy-client:jar:3.13.2.Final:compile [INFO] | | ± org.jboss.spec.javax.ws.rs:jboss-jaxrs-api\_2.1\_spec:jar:2.0.1.Final:compile [INFO] | | ± org.jboss.resteasy:resteasy-jaxrs:jar:3.13.2.Final:compile [INFO] | | | ± org.reactivestreams:reactive-streams:jar:1.0.3:compile [INFO] | | | ± org.jboss.spec.javax.annotation:jboss-annotations-api\_1.3\_spec:jar:2.0.1.Final:compile [INFO] | | | - com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile [INFO] | | ± org.apache.httpcomponents:httpclient:jar:4.5.12:compile [INFO] | | | - commons-logging:commons-logging:jar:1.2:compile [INFO] | | ± commons-codec:commons-codec:jar:1.13:compile [INFO] | | - commons-io:commons-io:jar:2.5:compile