Apache Commons Codec 1.23.0 Fixes Two Flaws as Apache HTTP Server 2.4.70 Patches Memory Bugs

TL;DR

The Apache Software Foundation disclosed two Apache Commons Codec vulnerabilities on November 9, 2026, tracked as CVE-2026-119078 and CVE-2026-124077. Both affect hashing features in the Java library and are fixed or documented in version 1.23.0. Separately, Apache HTTP Server 2.4.70 shipped with fixes for a heap buffer overflow and an integer overflow.

A Blake3 documentation error in Apache Commons Codec can lead apps to derive identical keys. A second bug lets two different Git trees share one identifier. Upgrade Codec to 1.23.0 and httpd to 2.4.70, and review any Blake3 code by hand.

Why It Matters

Libraries like Commons Codec often sit deep in dependency trees. As a result, teams may not know they use the affected classes. No exploitation or public exploit has been reported for either flaw.

How the Attack Works

CVE-2026-119078: repeated Blake3 output

The Blake3 class Javadoc claimed that repeated doFinalize calls return new output. In reality, “calling it again without supplying more input returns the same bytes.” The shipped key-derivation example used two such calls. Therefore, code that copied it “gets identical keys, so the separation between the derived keys is lost.”

CVE-2026-124077: Git tree collisions

The GitIdentifiers class did not reject NUL bytes in tree entry names. Since Git uses NUL to end each name, a crafted name can make two trees hash to the same ID or SWHID. However, the impact is limited. Only apps that build trees from untrusted names, such as ZIP entries, are exposed.

Apache HTTP Server fixes

Meanwhile, httpd 2.4.70 fixes a heap buffer overflow in mod_dav_lock and an integer overflow in mod_substitute. The release assigns no CVEs to these bugs.

Affected Versions

• CVE-2026-119078: Apache Commons Codec 1.16.0 before 1.23.0
• CVE-2026-124077: Apache Commons Codec 1.22.0 before 1.23.0
• Apache HTTP Server 2.4.69 and earlier

Patch and Mitigation

Get version 1.23.0 from the Apache Commons Codec download page. Note that “upgrading alone does not fix affected code” for the Blake3 issue. Instead, request the combined key length in one call and split the output. Finally, install the latest build from the Apache HTTP Server download page.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.