Skip to content
OpenAdvisories

Package · Ubuntu

libcommons-codec-java

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-119078

    Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys

    Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again w…

    Apache Software Foundation Apache Commons Codec libcommons-codec-java Ubuntu