International
The Morning Dev

Only the news worth knowing

‹
 
C21/100

Vulnerability · low

Apache Commons Codec NUL bytes cause Git identifier collisions (CVE-2026-124077)

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Apps using Commons Codec 1.22.0 GitIdentifiers for Git/SWHID IDs

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

Popular tool

What to do

  1. Upgrade Apache Commons Codec to 1.23.0 or later

The Brief

  • Apache Commons Codec versions 1.22.0 up to 1.23.0 (and a pre-release commit) mishandle NUL bytes in tree entry names in the GitIdentifiers class.
  • The flaw causes Git/SWHID identifier collisions, tracked as CVE-2026-124077.
  • The advisory rates severity as low and was posted to oss-security by Gary D. Gregory on 2026-11-09.

Why it matters

Code that uses GitIdentifiers to compute Git or SWHID identifiers for tree entries can get colliding identifiers for different content, which can mislead integrity checks or content addressing.

The checklist behind the tier

Checklist · 2 of 10 yes
YesHits tech teamsJudgment: Apache Commons Codec is a Java library that developers build with, so it is in scope.
NoCore infrastructureJudgment: a single Java utility library, not software nearly every team runs like OpenSSH or glibc.
YesPopular toolJudgment: Commons Codec is a widely used Java library across many projects.
NoExploited in the wildOpen Source Security: described as a low-severity identifier collision; no observed attacks reported.
NoPublic exploitOpen Source Security: advisory only; no published exploit or PoC is mentioned in the excerpt.
NoRemote, no loginOpen Source Security: the issue concerns GitIdentifiers tree entry names; no remote unauthenticated attack path is stated.
NoFull takeoverOpen Source Security: identifier collisions only; no code execution or privilege escalation is reported.
NoSecrets exposedOpen Source Security: no data theft or exposure of credentials or user data is reported.
NoSupply chainOpen Source Security: a normal bug in legitimate code; no malicious code shipping is reported.
NoNo fix yetOpen Source Security: affected versions are fixed in 1.23.0 and a patched commit is listed.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-124077 ↗

    Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)

    Exploited
    Not in CISA’s exploited catalog
    Weakness
    CWE-158

    NVDGHSA-26mf-gqw6-894w

Timeline

  1. Advisory posted to oss-security mailing list

  2. Open Source Security

    CVE-2026-124077: Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)

Source

CVE-2026-124077: Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class) ↗ Open Source Security · 2h ago

First seen · 1 source · Full story page · How tiers are decided