There is a bug in Base32 implementation in Apache Commons Codecs:
Example, there is no byte array value that can be encoded into the string "C5CYMIHWQUUZMKUGZHGEOSJSQDE4L===", but the existing Base32 implementation would not reject it but decode it into an arbitrary value which if re-encoded again using the same implementation would result in the string "C5CYMIHWQUUZMKUGZHGEOSJSQDE4K===".
Instead of blindly decoding the invalid string, the Base32 codec should reject it (eg by throwing IlleglArgumentException) to avoid security exploitation (such as tunneling additional information via seemingly valid base 32 strings).
What I do not understand is how can an attacker use this bug to tunnel additional information. The attacker sends invalid base32 string and obtains a slightly different base32 string back. What harm can it cause?