CVE-2026-124077: Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)

The Brief

Apache Commons Codec versions 1.22.0 up to 1.23.0 (and a pre-release commit) mishandle NUL bytes in tree entry names in the GitIdentifiers class.
The flaw causes Git/SWHID identifier collisions, tracked as CVE-2026-124077.
The advisory rates severity as low and was posted to oss-security by Gary D. Gregory on 2026-11-09.

Why it matters

Code that uses GitIdentifiers to compute Git or SWHID identifiers for tree entries can get colliding identifiers for different content, which can mislead integrity checks or content addressing.

Who’s affected

Projects using Apache Commons Codec 1.22.0 GitIdentifiers

What to do

Upgrade Apache Commons Codec to 1.23.0 or later

Apache Commons Codec 1.22.0
Apache Commons Codec 1.23.0
CVE-2026-124077
#security
#apache-commons
#java
#git
#identifiers

Posted by Gary D. Gregory on Nov 09 Severity: low Affected versions: - Apache Commons Codec 1.22.0 before 1.23.0 - Apache Commons Codec 387120c901f4a75c3112dfdf8877dcdec7ae685d before 87f6aa2818836998528ff4b0d1ea35545a800ee5 Description: The GitIdentifiers class in Apache Commons…

Read the full story at seclists.org ↗

Timeline

Nov 9
Advisory posted to oss-security mailing list
Nov 9 · 9:54 PM
Open Source Security
CVE-2026-124077: Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)