Apache Commons Codec Blake3 doFinalize is stateless (CVE-2026-119078)
Original title: CVE-2026-119078: Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys
Repeated doFinalize calls without new input return the same bytes, so the documented KDF example derives identical keys.
Gary D. Gregory reported CVE-2026-119078 in Apache Commons Codec, rated important. Blake3.doFinalize was documented as depending on previously finalized bytes, but it does not change hash state, so another call without more input returns the same bytes. Affected versions are Apache Commons Codec 1.16.0 before 1.23.0. The notice is cut off at the key-derivation example.
Unconfirmed: The snippet cuts off before describing the KDF example or a stated fix.
- Severity is listed as important.
- Affected range is Apache Commons Codec 1.16.0 before 1.23.0.
- The flaw is incorrect state handling in Blake3.doFinalize, not a stated remote exploit.
Impact: Identical keys from the documented Blake3 KDF example
| Product | Affected |
|---|---|
| Apache Commons Codec | 1.16.0 before 1.23.0 |
- 1.Upgrade Apache Commons Codec to 1.23.0 or later.
- CVEs
- CVE-2026-119078
- Vendors
- Apache
- Products
- Apache Commons Codec
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119078 | Identical Blake3 keys from repeated doFinalize in Commons Codec | — | — |
From the original article
Posted by Gary D. Gregory on Nov 09 Severity: important Affected versions: - Apache Commons Codec 1. 16.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.