Revert httpclient, httpcore version. As Horia pointed out, httpclient 4.3.5, httpcore 4.3.2 is the only avaiable version fixed the CVE in community version