# CVE-2026-124077: Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/610) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-124077-apache-commons-codec-nul-bytes-in-tree-entry-names-cause-git-swh-aa4467a7bc8edf68
Kind: security · Impact: low

## In brief

- Apache Commons Codec versions 1.22.0 up to 1.23.0 (and a pre-release commit) mishandle NUL bytes in tree entry names in the GitIdentifiers class.
- The flaw causes Git/SWHID identifier collisions, tracked as CVE-2026-124077.
- The advisory rates severity as low and was posted to oss-security by Gary D. Gregory on 2026-11-09.

## Why it matters

Code that uses GitIdentifiers to compute Git or SWHID identifiers for tree entries can get colliding identifiers for different content, which can mislead integrity checks or content addressing.

## What to do

- Upgrade Apache Commons Codec to 1.23.0 or later

## Versions

- Apache Commons Codec 1.22.0
- Apache Commons Codec 1.23.0

## CVEs

- CVE-2026-124077

## Timeline

- 2026-11-09: Advisory posted to oss-security mailing list

## Coverage

- [CVE-2026-124077: Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)](https://seclists.org/oss-sec/2026/q4/610) — Open Source Security, 2026-11-09

Tags: security, apache-commons, java, git, identifiers

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev