CVE-2026-124077
Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)
CVE-2026-124077 is a medium vulnerability (CVSS 4.3) in Apache Software Foundation Commons Codec, published November 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.34%EPSS, 28th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID.
The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed.
This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0.
Users are recommended to upgrade to version 1.23.0, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
Discussion
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libcommons-codec-javaUbuntu:14.04:LTS | All versions, plus listed versions 1.8-11.9-1 | None known |
libcommons-codec-javaUbuntu:16.04:LTS | All versions, plus listed versions 1.10-1 | None known |
libcommons-codec-javaUbuntu:18.04:LTS | All versions, plus listed versions 1.10-11.11-1 | None known |
libcommons-codec-javaUbuntu:20.04:LTS | All versions, plus listed versions 1.11-11.14-1 | None known |
libcommons-codec-javaUbuntu:22.04:LTS | All versions, plus listed versions 1.15-1 | None known |
libcommons-codec-javaUbuntu:24.04:LTS | All versions, plus listed versions 1.15-11.16.0-1 | None known |
libcommons-codec-javaUbuntu:26.10 | All versions, plus listed versions 1.18.0-11.22.0-1 | None known |
libcommons-codec-javaUbuntu:26.04:LTS | All versions, plus listed versions 1.18.0-1 | None known |
apache-commons-codecopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 1.23.0-1.1 | 1.23.0-1.1 |
What each source reports
CVE List Score used
Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID.
The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed.
This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0.
Users are recommended to upgrade to version 1.23.0, which fixes the issue.
- Record
CVE-2026-124077- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-158
- Updated
- 2026-11-12
EUVDEUVD-2026-120399
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID.
The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed.
This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0.
Users are recommended to upgrade to version 1.23.0, which fixes the issue.
- Record
EUVD-2026-120399- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-26mf-gqw6-894w
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names....
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID.
The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed.
This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0.
Users are recommended to upgrade to version 1.23.0, which fixes the issue.
- Record
GHSA-26mf-gqw6-894w- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-158
- Updated
- 2026-11-12
NVD
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID.
The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed.
This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0.
Users are recommended to upgrade to version 1.23.0, which fixes the issue.
- Record
CVE-2026-124077- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-158
- Updated
- 2026-11-12
OSV
Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID.
The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed.
This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0.
Users are recommended to upgrade to version 1.23.0, which fixes the issue.
- Record
CVE-2026-124077- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-158
- Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-124077
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID. The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed. This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0. Users are recommended to upgrade to version 1.23.0, which fixes the issue.
- Record
UBUNTU-CVE-2026-124077- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-13
OSVopenSUSE-SU-2026:12523-1No score
apache-commons-codec-1.23.0-1.1 on GA media
These are all security issues fixed in the apache-commons-codec-1.23.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12523-1- Updated
- 2026-11-12
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| severity | CVE List, EUVD, GitHub Advisories, NVD | |
| affected, aliases, references | OSV | |
| references | OSV | |
| references | GitHub Advisories, NVD, OSV | |
| references | CVE List | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | GitHub Advisories | |
| cwes, references, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/apache/commons-codec/commit/87f6aa2818836998528ff4b0d1ea35545a800ee5.patch
lists.apache.org/thread.html/zns7tbnkq685prps9d85q7ct6oobvzsm
openwall.com/lists/oss-security/2026/11/09/30
nvd.nist.gov/vuln/detail/CVE-2026-124077
repo.maven.apache.org/maven2