# CVE-2026-119078: Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/609) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-119078-apache-commons-codec-blake3-dofinalize-is-stateless-the-document-2895c222c6610986
Kind: security · Impact: high

## In brief

- CVE-2026-119078 affects Apache Commons Codec 1.16.0 before 1.23.0.
- Blake3 doFinalize output does not depend on previously finalized bytes, so it is stateless.
- The documented KDF example derives identical keys from its inputs.

## Why it matters

Applications using the Blake3 KDF from Apache Commons Codec in affected versions may derive the same key material where unique keys are expected, weakening the security of anything built on those keys.

## What to do

- Upgrade Apache Commons Codec to 1.23.0 or later.
- Review code that uses Blake3 doFinalize for key derivation and assess keys derived with affected versions.

## Versions

- Apache Commons Codec 1.16.0
- Apache Commons Codec 1.23.0

## CVEs

- CVE-2026-119078

## Timeline

- 2026-11-09: Advisory posted to oss-sec by Gary D. Gregory

## Coverage

- [CVE-2026-119078: Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys](https://seclists.org/oss-sec/2026/q4/609) — Open Source Security, 2026-11-09

Tags: apache, java, security, cryptography, kdf, blake3

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev