International
The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 21 · Tier C

CVE-2026-119078: Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys

oss-security ·

The Brief

  • CVE-2026-119078 affects Apache Commons Codec 1.16.0 before 1.23.0.
  • Blake3 doFinalize output does not depend on previously finalized bytes, so it is stateless.
  • The documented KDF example derives identical keys from its inputs.

Why it matters

Applications using the Blake3 KDF from Apache Commons Codec in affected versions may derive the same key material where unique keys are expected, weakening the security of anything built on those keys.

Who’s affected

  • Projects using Apache Commons Codec Blake3 in versions 1.16.0 to 1.22.x
  • Teams relying on the Blake3 KDF example for key derivation

What to do

  1. Upgrade Apache Commons Codec to 1.23.0 or later.
  2. Review code that uses Blake3 doFinalize for key derivation and assess keys derived with affected versions.

Posted by Gary D. Gregory on Nov 09 Severity: important Affected versions: - Apache Commons Codec 1.16.0 before 1.23.0 Description: Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that…

Read the full story at seclists.org ↗

Timeline

  1. Advisory posted to oss-sec by Gary D. Gregory

  2. Open Source Security

    CVE-2026-119078: Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys

How do you feel about this?

0 Comments

    CVE-2026-119078: Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys – The Morning Dev