CVE-2026-124077 · Package
NO FIX YET · SEE WHAT TO DO
The GitIdentifiers class in Apache Commons Codec 1.22.0 before 1.23.0 accepts NUL bytes in tree entry names, so two different directory trees can serialize to the same Git tree identifier or SWHID. The impact is limited to applications that build trees from untrusted names, such as ZIP entry names or names passed directly to the API.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that use Apache Commons Codec 1.22.0 and build Git tree identifiers or SWHIDs from names supplied by other sources, such as ZIP entry names or names passed directly to the API. Trees built by walking a normal file system are not affected, because common file systems do not allow NUL bytes in file names.
Not affected if file-system-trees-only, not-version-1.22.0
Who cares apache-commons-codec, java, swhid
mvn dependency:tree or gradle dependencies) and see whether it is 1.22.0.1.23.0.The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID.
The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed.
This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0.
Users are recommended to upgrade to version 1.23.0, which fixes the issue.
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.