CVE-2026-124077

Received Received - Intake

Tree Identifier Collision in Apache Commons Codec

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: Apache Software Foundation

Description

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID. The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed. This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0. Users are recommended to upgrade to version 1.23.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-09

Last Modified

2026-11-09

Generated

2026-11-10

AI Q&A

2026-11-10

EPSS Evaluated

N/A

NVD

CVE-2026-124077

EUVD

EUVD-2026-120399

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Commons Codec	From 1.22.0 (inc) to 1.23.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-158	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache Commons Codec involves the GitIdentifiers class not rejecting NUL bytes in Git tree entry names. Git uses NUL bytes to mark the end of entry names, so a crafted name could make two different directory trees serialize to the same Git tree identifier or SWHID. This could cause two different trees to receive the same identifier.

Detection Guidance

To detect this vulnerability, check if your system uses Apache Commons Codec versions 1.22.0 or earlier. Run commands like 'mvn dependency:tree' in Maven projects or inspect dependency files for commons-codec versions.

Impact Analysis

The impact is limited because common file systems do not allow NUL bytes in file names. Only applications that build trees from names supplied by other sources, such as archive formats like ZIP or names passed directly to the API, are exposed. Attackers could exploit this to manipulate tree identifiers.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. The issue is limited to Git tree identifier generation in Apache Commons Codec and requires specific conditions (e.g., crafted names with NUL bytes) that are not typical in standard file systems. No evidence suggests this vulnerability leads to data breaches or unauthorized access.

Mitigation Strategies

Upgrade Apache Commons Codec to version 1.23.0 or later. This version includes fixes for invalid entry names and prevents serialization collisions. Verify the upgrade by checking the library version in your project dependencies.

Hi! I’m here to help you understand CVE-2026-124077. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...