Apache Commons Codec GitIdentifiers collide on NUL entry names
Original title: CVE-2026-124077: Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)
Apache rates the flaw low; Codec 1.22.0 before 1.23.0 and one earlier commit range are affected.
Gary D. Gregory reported CVE-2026-124077 in Apache Commons Codec. The GitIdentifiers class did not reject NUL bytes in tree entry names, and a crafted name could make one tree serialize to the same bytes as another because Git uses a NUL byte to end each entry name. Apache rates severity low. Affected ranges are 1.22.0 before 1.23.0 and commit 387120c901f4a75c3112dfdf8877dcdec7ae685d before 87f6aa2818836998528ff4b0d1ea35545a800ee5.
Unconfirmed: The posted description is cut off before fully explaining the collision outcome.
- The flaw is in the GitIdentifiers class.
- Fixed release named in the ranges is 1.23.0.
- The fixed commit cited is 87f6aa2818836998528ff4b0d1ea35545a800ee5.
- Apache's stated severity is low.
Impact: Crafted names can cause Git or SWHID identifier collisions
| Product | Affected | Fixed in |
|---|---|---|
| Apache Commons Codec | 1.22.0 before 1.23.0; commit 387120c901f4a75c3112dfdf8877dcdec7ae685d before 87f6aa2818836998528ff4b0d1ea35545a800ee5 | 1.23.0; 87f6aa2818836998528ff4b0d1ea35545a800ee5 |
- 1.Upgrade Apache Commons Codec to 1.23.0.
- CVEs
- CVE-2026-124077
- Vendors
- Apache
- Products
- Apache Commons Codec
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124077 | NUL-byte Git/SWHID collision in Apache Commons Codec | — | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 387120c901f4a75c3112dfdf8877dcdec7ae685d | e Commons Codec 1.22.0 before 1.23.0 - Apache Commons Codec 387120c901f4a75c3112dfdf8877dcdec7ae685d before 87f6aa2818836998528ff4b0d1ea35545a800ee5 Description |
| sha1 | 87f6aa2818836998528ff4b0d1ea35545a800ee5 | mmons Codec 387120c901f4a75c3112dfdf8877dcdec7ae685d before 87f6aa2818836998528ff4b0d1ea35545a800ee5 Description: The GitIdentifiers class in Apache Commons Cod |
From the original article
Posted by Gary D. Gregory on Nov 09 Severity: low Affected versions: - Apache Commons Codec 1. 22.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.