---
id: "CVE-2026-124077"
page: "https://infrastack.ai/live/CVE-2026-124077"
kind: "vulnerability"
aliases: ["CVE-2026-124077"]
title: "Apache Commons Codec: Git tree IDs collide when names contain NUL bytes"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-commons-codec", "java", "package", "swhid"]
not_affected_if: ["file-system-trees-only", "not-version-1.22.0"]
published_at: "2026-11-09T20:18:10+00:00"
first_seen_at: "2026-11-09T20:48:12+00:00"
updated_at: "2026-11-09T20:50:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124077", "first_seen_at": "2026-11-09T20:48:12+00:00"}]
exploit_sources: []
---

# Apache Commons Codec: Git tree IDs collide when names contain NUL bytes

Link for people: https://infrastack.ai/live/CVE-2026-124077 (this .md is for agents)

The GitIdentifiers class in Apache Commons Codec 1.22.0 before 1.23.0 accepts NUL bytes in tree entry names, so two different directory trees can serialize to the same Git tree identifier or SWHID. The impact is limited to applications that build trees from untrusted names, such as ZIP entry names or names passed directly to the API.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Apache Commons Codec version in your build file or lockfile (for example `mvn dependency:tree` or `gradle dependencies`) and see whether it is `1.22.0`.
- Look for code that calls GitIdentifiers or builds Git tree identifiers or SWHIDs from archive entry names or other external input.

## Fix

- Apache Commons Codec: upgrade to `1.23.0`.

## Timeline

- 2026-11-09T20:48:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124077

## Documents

- [fix] Patch: github.com https://github.com/apache/commons-codec/commit/87f6aa2818836998528ff4b0d1ea35545a800ee5.patch

## From the sources

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID.



The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed.



This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0.



Users are recommended to upgrade to version 1.23.0, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_