Apache Commons Codec

Search everything

Mentions · 7d2
Mentions · 30d2
All mentions2
First seenNov 9, 2026
Last mentioned1d ago

Timeline

2 articles · newest first

Apache Commons Codec GitIdentifiers collide on NUL entry names

Apache rates the flaw low; Codec 1.22.0 before 1.23.0 and one earlier commit range are affected.

oss-securityNov 9, 21:54 UTC · 1d agoVulnerability 2 sourcesCVE-2026-124077

Apache Commons Codec Blake3 doFinalize is stateless (CVE-2026-119078)

Repeated doFinalize calls without new input return the same bytes, so the documented KDF example derives identical keys.

oss-securityNov 9, 21:52 UTC · 1d agoVulnerability 2 sourcesCVE-2026-119078

Related CVEs

by mentions

CVE-2026-119078—
Identical Blake3 keys from repeated doFinalize in Commons Codec
published 2d agoApache Commons Codec
CVE-2026-124077—
NUL-byte Git/SWHID collision in Apache Commons Codec
published 2d agoApache Commons Codec

Appears with

Apachevendor · 2

Entities are extracted by the model from each article. First seen Nov 9, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.