Apache Commons Codec Blake3 doFinalize can derive identical keys
First merged summary.
Apache rates CVE-2026-119078 important: Blake3.doFinalize in Codec before 1.23.0 can return identical bytes.
Gary D. Gregory reported CVE-2026-119078 in Apache Commons Codec, which Apache rates important. Blake3.doFinalize was documented as depending on previously finalized bytes, but it does not change hash state, so another call without more input returns the same bytes. Repeated calls can therefore make the documented key-derivation example derive identical keys. Affected versions are Apache Commons Codec 1.16.0 before 1.23.0. The published notice is cut off at the key-derivation example, and no remote exploit is stated.
- CVE-2026-119078 is rated important by Apache.
- Affected versions are Commons Codec 1.16.0 before 1.23.0.
- Blake3.doFinalize does not update hash state.
- Repeated calls without new input return the same bytes.
- Gary D. Gregory reported the flaw; no remote exploit is stated.
Timeline
dated events in the reporting · oldest first- Nov 9, 2026oss-security publishes the Blake3 doFinalize advisory. · oss-security
What each outlet adds
beyond the shared facts- oss-securityNames the important Blake3 state bug and the 1.16.0–1.23.0 range.
- Vendors
- Apache
- Products
- Apache Commons Codec
Coverage
oldest first · one row per article · UTC- · 1d ago
oss-securityFirst report
Apache Commons Codec Blake3 doFinalize is stateless (CVE-2026-119078)
Repeated doFinalize calls without new input return the same bytes, so the documented KDF example derives identical keys.
- · 1d ago
Apache Commons Codec GitIdentifiers collide on NUL entry names
Apache rates the flaw low; Codec 1.22.0 before 1.23.0 and one earlier commit range are affected.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-119078+1 related CVE | Identical Blake3 keys from repeated doFinalize in Commons Codec | — | — |