Apache fixes two Commons Codec flaws in version 1.23.0

Apache Software Foundation researchers disclosed two vulnerabilities in Apache Commons Codec on 9 November 2026, tracked as CVE-2026-119078 (CWE-684) and CVE-2026-124077 (CWE-158). Both affect hashing features in the Java library and are addressed in Codec version 1.23.0. Separately, Apache HTTP Server 2.4.70 includes fixes for a heap buffer overflow in mod_dav_lock and an integer overflow in mod_substitute, with no CVEs assigned to those fixes. The note from the report says there is no confirmed exploitation at this time, and patches are available.

CVE-2026-119078 involves the Blake3 class, where the Javadoc claimed repeated doFinalize calls produced new output, but in practice repeated calls without additional input yield the same bytes; the key-derivation example in the package used two such calls, which could allow derived keys to be identical.

CVE-2026-124077 concerns GitIdentifiers not rejecting NUL bytes in tree entry names, enabling a crafted name to make two trees hash to the same ID or SWHID, though exposure is limited to apps building trees from untrusted names (e.g., ZIP entries). Affected versions are Apache Commons Codec 1.16.0 before 1.23.0 (CVE-2026-119078) and 1.22.0 before 1.23.0 (CVE-2026-124077), with Apache HTTP Server 2.4.69 and earlier also impacted.

Organisations should upgrade to Codec 1.23.0 and httpd 2.4.70, and for the Blake3 issue, review Blake3 code paths by hand and apply the combined key-length handling guidance.