International
The Morning Dev

Only the news worth knowing

‹
 
C21/100

Vulnerability · high

Apache Commons Codec Blake3 doFinalize is stateless, KDF example derives identical keys (CVE-2026-119078)

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Projects using Blake3 KDF in Apache Commons Codec 1.16.0 to 1.22.x

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

Popular tool

What to do

  1. Upgrade Apache Commons Codec to 1.23.0 or later.
  2. Review code that uses Blake3 doFinalize for key derivation and assess keys derived with affected versions.

The Brief

  • CVE-2026-119078 affects Apache Commons Codec 1.16.0 before 1.23.0.
  • Blake3 doFinalize output does not depend on previously finalized bytes, so it is stateless.
  • The documented KDF example derives identical keys from its inputs.

Why it matters

Applications using the Blake3 KDF from Apache Commons Codec in affected versions may derive the same key material where unique keys are expected, weakening the security of anything built on those keys.

The checklist behind the tier

Checklist · 2 of 10 yes
YesHits tech teamsApache Commons Codec is a Java library that developers build applications with.
NoCore infrastructureA single widely used library, not software nearly every team runs like OpenSSH or the Linux kernel.
YesPopular toolApache Commons Codec is a widely used mainstream Java library across many teams.
NoExploited in the wildOpen Source Security advisory describes the flaw only; it reports no observed attacks.
NoPublic exploitOpen Source Security advisory gives a description with no published exploit code or PoC.
NoRemote, no loginOpen Source Security advisory does not state any network or unauthenticated attack path.
NoFull takeoverOpen Source Security advisory describes stateless output and identical derived keys, not code execution or takeover.
NoSecrets exposedOpen Source Security advisory reports no stolen or exposed credentials or data.
NoSupply chainOpen Source Security advisory describes a normal bug in legitimate code, not a compromised package.
NoNo fix yetOpen Source Security advisory lists affected versions before 1.23.0, implying a fixed release exists.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-119078 ↗

    Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys

    Exploited
    Not in CISA’s exploited catalog
    Weakness
    CWE-684, CWE-1068

    NVDGHSA-rv28-228v-c565

Timeline

  1. Advisory posted to oss-sec by Gary D. Gregory

  2. Open Source Security

    CVE-2026-119078: Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys

Source

CVE-2026-119078: Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys ↗ Open Source Security · 2h ago

First seen · 1 source · Full story page · How tiers are decided