Checkmarx issue(SSRF) on queryparam String

Our controller looks like this:

public ResponseEntity<ServiceResponse<List<String>>> getItemIdentifiers(
        @RequestParam(required = true) String category_,
        @RequestParam(required = true) String calendarYear_,
        @RequestParam(required = false) String season_,
        @RequestParam(required = false) Long supplierId,
        @RequestParam(required = false) String itemDescription_,
        @RequestHeader String tenantId
) {
    String category = HtmlUtils.htmlEscape(category_); // this I've done to avoid vulnerablity
    String calendarYear = HtmlUtils.htmlEscape(calendarYear_);
    String season = HtmlUtils.htmlEscape(season_);
    String itemDescription = HtmlUtils.htmlEscape(itemDescription_);
    List<String> quoteSearchResponseItem = btrcService.getItemIdentifiers(category, calendarYear, season, supplierId, itemDescription);
    ServiceResponse<List<String>> serviceResponse = ServiceResponseBuilder.get(quoteSearchResponseItem);
    return ResponseEntity.ok(serviceResponse);
}

But I'm still getting this exception on codegate:

The application sends a request to a remote server, for some resource, using exchange in src\main\java\com\walmart\sams\services\allocation\configuration\service\BTRCService.java:45. However, an attacker can control the target of the request, by sending a URL or other data in season_ at src\main\java\com\walmart\sams\services\allocation\configuration\controller\BTRCApiController.java:31.

Similarity ID: -1246383384

The application sends a request to a remote server, for some resource, using exchange in

src\main\java\com\walmart\sams\services\allocation\configuration\service\BTRCService.java:45. However, an attacker can control the target of the request, by sending a URL or other data in calendarYear_ at src\main\java\com\walmart\sams\services\allocation\configuration\controller\BTRCApiController.java:30.Similarity ID: 574151291 --> Query Name : SSRF

etc. for category_, calendarYear_, season_ and itemDescription_. Please suggest a fix for this. The service method in turn calls RestTemplate passing these values in param using Restempltate exchange method. Using Spring 3x. Java 17.