High WID-SEC-2026-4431 2 CVEs

Apache Commons Codec: Mehrere Schwachstellen

Published Nov 9, 2026 · Updated Nov 9, 2026 · de

Vendor: Apache Product: Commons Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Commons Codec ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Daten zu manipulieren.

Product

Apache Commons ist ein Apache-Projekt, das alle Aspekte der wiederverwendbaren Java-Komponenten behandelt.

Vulnerabilities 2

Critical 9.1

CVE-2026-119078

Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys

Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again w…

Apache Software Foundation Apache Commons Codec javapackages-bootstrap libcommons-codec-java Ubuntu Azure Linux

Nov 9, 2026
Medium 4.3

CVE-2026-124077

Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree.…

Apache Software Foundation Apache Commons Codec libcommons-codec-java Ubuntu

Nov 9, 2026

Revision history

2026-11-09 #1
Initiale Fassung

References

OSS Security MAiling List vom 2026-11-09
https://seclists.org/oss-sec/2026/q4/610
OSS Security MAiling List vom 2026-11-09
https://seclists.org/oss-sec/2026/q4/609
CVE Record vom 2026-11-09
https://www.cve.org/CVERecord?id=CVE-2026-124077
CVE Record vom 2026-11-09
https://www.cve.org/CVERecord?id=CVE-2026-119078