diff --git a/bom/pom.xml b/bom/pom.xml
index a0f5d84a1ed50b9089a780b72dee11a0b243d750..df6185f8792624216eda1bccb0f63c21dfa8f6c6 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -162,7 +162,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>commons-codec</groupId>
         <artifactId>commons-codec</artifactId>
-        <version>1.12</version>
+        <version>1.14</version>
       </dependency>
 
       <dependency>
diff --git a/core/src/main/java/hudson/cli/Connection.java b/core/src/main/java/hudson/cli/Connection.java
index bdeb192fd3ee8fb2bd587354b23e4f0b4eb610f3..13cec3f6159f1dd6a2ea20d9eee55c5b0d883f01 100644
--- a/core/src/main/java/hudson/cli/Connection.java
+++ b/core/src/main/java/hudson/cli/Connection.java
@@ -27,7 +27,6 @@ import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.remoting.ClassFilter;
 import hudson.remoting.ObjectInputStreamEx;
 import hudson.remoting.SocketChannelStream;
-import org.apache.commons.codec.binary.Base64;
 
 import javax.crypto.Cipher;
 import javax.crypto.CipherInputStream;
@@ -56,6 +55,7 @@ import java.security.Signature;
 import java.security.interfaces.DSAPublicKey;
 import java.security.interfaces.RSAPublicKey;
 import java.security.spec.X509EncodedKeySpec;
+import java.util.Base64;
 import org.jenkinsci.remoting.util.AnonymousClassWarnings;
 
 /**
@@ -123,11 +123,11 @@ public class Connection {
     }
 
     public void writeKey(Key key) throws IOException {
-        writeUTF(new String(Base64.encodeBase64(key.getEncoded())));
+        writeUTF(Base64.getEncoder().encodeToString(key.getEncoded()));
     }
 
     public X509EncodedKeySpec readKey() throws IOException {
-        byte[] otherHalf = Base64.decodeBase64(readUTF()); // for historical reasons, we don't use readByteArray()
+        byte[] otherHalf = Base64.getDecoder().decode(readUTF()); // for historical reasons, we don't use readByteArray()
         return new X509EncodedKeySpec(otherHalf);
     }
 
diff --git a/core/src/main/java/hudson/console/ConsoleNote.java b/core/src/main/java/hudson/console/ConsoleNote.java
index e55f7c2629eb4f2aee213826c0f36fa512ea0695..b4227b970772a3b502f3b95041a0cf4d872cc36f 100644
--- a/core/src/main/java/hudson/console/ConsoleNote.java
+++ b/core/src/main/java/hudson/console/ConsoleNote.java
@@ -32,8 +32,6 @@ import jenkins.model.Jenkins;
 import hudson.model.Run;
 import hudson.remoting.ObjectInputStreamEx;
 import hudson.util.IOUtils;
-import hudson.util.UnbufferedBase64InputStream;
-import org.apache.commons.codec.binary.Base64OutputStream;
 import org.apache.commons.io.output.ByteArrayOutputStream;
 import org.apache.tools.ant.BuildListener;
 
@@ -48,6 +46,7 @@ import java.io.Serializable;
 import java.io.Writer;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Base64;
 import java.util.Collection;
 import java.util.List;
 import com.jcraft.jzlib.GZIPInputStream;
@@ -204,7 +203,7 @@ public abstract class ConsoleNote<T> implements Serializable, Describable<Consol
 
         ByteArrayOutputStream buf2 = new ByteArrayOutputStream();
 
-        try (DataOutputStream dos = new DataOutputStream(new Base64OutputStream(buf2, true, -1, null))) {
+        try (DataOutputStream dos = new DataOutputStream(Base64.getEncoder().wrap(buf2))) {
             buf2.write(PREAMBLE);
             if (JenkinsJVM.isJenkinsJVM()) { // else we are in another JVM and cannot sign; result will be ignored unless INSECURE
                 byte[] mac = MAC.mac(buf.toByteArray());
@@ -240,7 +239,7 @@ public abstract class ConsoleNote<T> implements Serializable, Describable<Consol
             if (!Arrays.equals(preamble,PREAMBLE))
                 return null;    // not a valid preamble
 
-            DataInputStream decoded = new DataInputStream(new UnbufferedBase64InputStream(in));
+            DataInputStream decoded = new DataInputStream(Base64.getDecoder().wrap(in));
             int macSz = - decoded.readInt();
             byte[] mac;
             int sz;
@@ -299,7 +298,7 @@ public abstract class ConsoleNote<T> implements Serializable, Describable<Consol
         if (!Arrays.equals(preamble,PREAMBLE))
             return;    // not a valid preamble
 
-        DataInputStream decoded = new DataInputStream(new UnbufferedBase64InputStream(in));
+        DataInputStream decoded = new DataInputStream(Base64.getDecoder().wrap(in));
         int macSz = - decoded.readInt();
         if (macSz > 0) { // new format
             IOUtils.skip(decoded, macSz);
diff --git a/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java b/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java
index 16f55502db9f4ce5f24dedbdec3cd24a99f51995..72d3fc8e6c876324b2d6806786aa66463fe5f942 100644
--- a/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java
+++ b/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java
@@ -33,7 +33,6 @@ import jenkins.model.Jenkins;
 import jenkins.model.JenkinsLocationConfiguration;
 import jenkins.model.identity.InstanceIdentityProvider;
 import jenkins.util.UrlHelper;
-import org.apache.commons.codec.binary.Base64;
 import org.jenkinsci.Symbol;
 import org.kohsuke.accmod.Restricted;
 import org.kohsuke.accmod.restrictions.Beta;
@@ -50,6 +49,7 @@ import java.net.MalformedURLException;
 import java.net.URL;
 import java.net.URLConnection;
 import java.security.interfaces.RSAPublicKey;
+import java.util.Base64;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import edu.umd.cs.findbugs.annotations.CheckForNull;
@@ -158,7 +158,7 @@ public final class ResourceDomainConfiguration extends GlobalConfiguration {
                     // URL points to a Jenkins instance
                     RSAPublicKey publicKey = InstanceIdentityProvider.RSA.getPublicKey();
                     if (publicKey != null) {
-                        String identity = Base64.encodeBase64String(publicKey.getEncoded());
+                        String identity = Base64.getEncoder().encodeToString(publicKey.getEncoded());
                         if (identity.equals(identityHeader)) {
                             return FormValidation.ok(Messages.ResourceDomainConfiguration_ThisJenkins());
                         }