EN PT-BR
← Voltar ao feed
medium

Apache Commons Codec Blake3 KDF and Git tree ID flaws patched in 1.23.0; httpd 2.4.70 fixes memory bugs

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 01:04 · coletado há 1 hora

The Apache Software Foundation disclosed two flaws in Apache Commons Codec on November 9, 2026: CVE-2026-119078, a Blake3 doFinalize behaviour that the documentation misdescribed, and CVE-2026-124077, a NUL-byte handling gap in GitIdentifiers (github.com/apache/commons-codec/commit/87f6aa2818836998528ff4b0d1ea35545a800ee5.patch, lists.apache.org, cve.threatint.com). Both are fixed in 1.23.0, but the Blake3 fix is documentation only, so upgrading does not repair code that already derives keys by calling doFinalize repeatedly. The Apache-supplied severity for CVE-2026-124077 is low, and no CVSS score was published for CVE-2026-119078 (mail-archive.com, strix.ai). No exploitation or public exploit has been reported. Separately, Apache HTTP Server 2.4.70, released November 6, 2026, fixes a heap buffer overflow in mod_dav_lock and an integer overflow in mod_substitute without assigning CVEs (httpd.apache.org/download.cgi, pbxscience.com, linuxcompatible.org).

Entenda a falha

A vulnerabilidade

Two flaws in Apache Commons Codec, both fixed in 1.23.0. CVE-2026-119078 (CWE-684, CWE-1068) is in the Blake3 class: the Javadoc said repeated doFinalize calls return new output, but they return the same bytes. The key-derivation example shipped since 1.16.0 therefore yields identical keys and loses key separation. Affected: 1.16.0 up to before 1.23.0; no CVSS score has been published. CVE-2026-124077 (CWE-158) is in GitIdentifiers (1.22.0 up to before 1.23.0), which accepted NUL bytes in tree entry names, so two different trees can get the same Git tree ID or SWHID. Apache rates it low. It affects only apps that build trees from untrusted names, such as ZIP entries. No exploitation has been reported. Separately, httpd 2.4.70 fixes memory bugs in mod_dav_lock and mod_substitute without assigning CVEs.

Como funciona

For CVE-2026-119078, a developer follows the Blake3 documentation and example: create one Blake3 instance in key-derivation mode, feed it input, then call doFinalize twice to get two keys. Because doFinalize does not advance the hash state, the second call with no new input returns the same bytes as the first, so both keys are identical. For CVE-2026-124077, an application passes entry names, for example from a ZIP archive, to GitIdentifiers to compute a Git tree ID. Git ends each entry name at a NUL byte, so a name containing NUL serializes to the same bytes as a different tree, and both get the same ID.

Por que é vulnerável

CVE-2026-119078 is a documentation and example error: the Javadoc described doFinalize as producing new output on each call, which is not how it behaves, and the doFinalize behaviour itself is unchanged. The 1.23.0 fix only corrects the example and clarifies finalization semantics, so upgrading does not repair code that already calls doFinalize repeatedly. CVE-2026-124077 is a missing input check: GitIdentifiers did not reject NUL bytes in tree entry names, which Git treats as terminators. The fix rejects empty and ambiguous entry names and file/directory name conflicts.

Onde está

In apache/commons-codec: the Blake3 class (Javadoc and key-derivation example) and the GitIdentifiers class; the CVE-2026-124077 fix is commit 87f6aa2818836998528ff4b0d1ea35545a800ee5, titled "Reject ambiguous GitIdentifiers tree entry names".

Como foi descoberta

The articles do not say who found either flaw or how. The Apache Software Foundation disclosed both on November 9, 2026 through its advisory. A mirror fork's pull-request page shows the fix commit by garydgregory dated September 18, 2026; the upstream pull request and merge date were not confirmed. The changes page lists 1.23.0 as released 2026-10-04, while Maven Central shows Oct 12, 2026. No exploitation has been reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 02:16.

Detalhes técnicos

  • CVE-2026-119078 (CWE-684, CWE-1068): the Blake3 Javadoc said repeated doFinalize calls on one instance return new output. In fact the call does not advance the hash state, so calling it again with no new input returns the same bytes. The key-derivation example shipped since 1.16.0 makes two such calls, so its derived keys are identical and their separation is lost. The affected range is 1.16.0 before 1.23.0 (mail-archive.com, cve.threatint.com, radar.offseq.com).
  • CVE-2026-124077 (CWE-158): GitIdentifiers accepted NUL bytes in tree entry names. Git ends each entry name at a NUL byte, so two different directory trees can serialize to the same bytes and receive the same Git tree ID or SWHID. Common file systems forbid NUL in names, so trees walked from disk are unaffected; the exposure is limited to trees built from archive entries such as ZIP or from names passed directly to the API. The affected range is 1.22.0 before 1.23.0, plus the Git-branch range from 387120c901f4a75c3112dfdf8877dcdec7ae685d before 87f6aa2818836998528ff4b0d1ea35545a800ee5 (mail-archive.com, strix.ai).
  • Apache HTTP Server 2.4.70: the release fixes a heap buffer overflow in dav_size_indirect() of mod_dav_lock, which under-reserved space for a key length, and an integer overflow in mod_substitute that appears only in specific configurations. The release also addresses other issues but assigns no CVE to any of them (linuxcompatible.org, pbxscience.com, codeit.guru).

Detalhes da correção

  • CVE-2026-124077: the fix is commit 87f6aa2818836998528ff4b0d1ea35545a800ee5 in apache/commons-codec. A mirror fork's pull-request page (github.com/johnperez416/commons-codec/pull/204) shows the commit titled "Reject ambiguous GitIdentifiers tree entry names", with commits by garydgregory dated September 18, 2026. The upstream pull-request number and merge date were not confirmed. The change rejects empty and ambiguous tree entry names and file/directory name conflicts (commons.apache.org/proper/commons-codec/changes.html). The fix ships in 1.23.0, listed in the changes page as released 2026-10-04 (commons.apache.org, mvnrepository.com).
  • CVE-2026-119078: the 1.23.0 changes page lists "Fix Blake3 KDF example and clarify finalization semantics" (commons.apache.org/proper/commons-codec/changes.html). The vendor advisory states that the doFinalize behaviour itself is unchanged (mail-archive.com).
  • httpd 2.4.70: the fixes are PR 70298 (mod_dav_lock, by Arturo Bernal) and PR 66034 (mod_substitute, by Rüdiger Pümml) (linuxcompatible.org). The release is published on httpd.apache.org/download.cgi.

Remediação

  • Upgrade Apache Commons Codec to 1.23.0 or later (Maven coordinates commons-codec:commons-codec).
  • Search the code for more than one doFinalize call on the same Blake3 instance. Replace those calls with a single call that requests the combined key length, then split the output. Upgrading alone does not fix this code (mail-archive.com).
  • Where the application builds Git trees from archive entries or caller-supplied names, treat CVE-2026-124077 as applicable. Libraries such as Commons Codec often sit deep in dependency trees, so check transitive dependencies too (securityonline.info).
  • Upgrade Apache HTTP Server to 2.4.70 (httpd.apache.org/download.cgi).

Relatos divergentes

  • The article lists the highest severity as "Awaiting analysis". Apache's own advisory rates CVE-2026-124077 as low (mail-archive.com), and CVE-2026-119078 has no CVSS score yet (strix.ai, radar.offseq.com).
  • The article calls CVE-2026-124077 a flaw with 1.23.0 as the fix and the commit as a second fixed reference. The CVE record also lists the commit hash as a fixed version, so the two references are consistent (cve.threatint.com).
  • Release dates differ: the Apache changes page gives 1.23.0 as 2026-10-04, while Maven Central lists 1.23.0 on Oct 12, 2026 (mvnrepository.com).

Linha do tempo

  1. securityonline.info ↗ · pub. 10/11/2026 01:04 · coletado 10/11 02:00 primeiro registro

    Apache Commons Codec Blake3 KDF and Git tree ID flaws patched in 1.23.0; httpd 2.4.70 fixes memory bugs

    ler a análise desta fonte

    The Apache Software Foundation disclosed two flaws in Apache Commons Codec on November 9, 2026: CVE-2026-119078, a Blake3 doFinalize behaviour that the documentation misdescribed, and CVE-2026-124077, a NUL-byte handling gap in GitIdentifiers (github.com/apache/commons-codec/commit/87f6aa2818836998528ff4b0d1ea35545a800ee5.patch, lists.apache.org, cve.threatint.com). Both are fixed in 1.23.0, but the Blake3 fix is documentation only, so upgrading does not repair code that already derives keys by calling doFinalize repeatedly. The Apache-supplied severity for CVE-2026-124077 is low, and no CVSS score was published for CVE-2026-119078 (mail-archive.com, strix.ai). No exploitation or public exploit has been reported. Separately, Apache HTTP Server 2.4.70, released November 6, 2026, fixes a heap buffer overflow in mod_dav_lock and an integer overflow in mod_substitute without assigning CVEs (httpd.apache.org/download.cgi, pbxscience.com, linuxcompatible.org).

    Technical Details

    • CVE-2026-119078 (CWE-684, CWE-1068): the Blake3 Javadoc said repeated doFinalize calls on one instance return new output. In fact the call does not advance the hash state, so calling it again with no new input returns the same bytes. The key-derivation example shipped since 1.16.0 makes two such calls, so its derived keys are identical and their separation is lost. The affected range is 1.16.0 before 1.23.0 (mail-archive.com, cve.threatint.com, radar.offseq.com).
    • CVE-2026-124077 (CWE-158): GitIdentifiers accepted NUL bytes in tree entry names. Git ends each entry name at a NUL byte, so two different directory trees can serialize to the same bytes and receive the same Git tree ID or SWHID. Common file systems forbid NUL in names, so trees walked from disk are unaffected; the exposure is limited to trees built from archive entries such as ZIP or from names passed directly to the API. The affected range is 1.22.0 before 1.23.0, plus the Git-branch range from 387120c901f4a75c3112dfdf8877dcdec7ae685d before 87f6aa2818836998528ff4b0d1ea35545a800ee5 (mail-archive.com, strix.ai).
    • Apache HTTP Server 2.4.70: the release fixes a heap buffer overflow in dav_size_indirect() of mod_dav_lock, which under-reserved space for a key length, and an integer overflow in mod_substitute that appears only in specific configurations. The release also addresses other issues but assigns no CVE to any of them (linuxcompatible.org, pbxscience.com, codeit.guru).

    Fix Details

    • CVE-2026-124077: the fix is commit 87f6aa2818836998528ff4b0d1ea35545a800ee5 in apache/commons-codec. A mirror fork's pull-request page (github.com/johnperez416/commons-codec/pull/204) shows the commit titled "Reject ambiguous GitIdentifiers tree entry names", with commits by garydgregory dated September 18, 2026. The upstream pull-request number and merge date were not confirmed. The change rejects empty and ambiguous tree entry names and file/directory name conflicts (commons.apache.org/proper/commons-codec/changes.html). The fix ships in 1.23.0, listed in the changes page as released 2026-10-04 (commons.apache.org, mvnrepository.com).
    • CVE-2026-119078: the 1.23.0 changes page lists "Fix Blake3 KDF example and clarify finalization semantics" (commons.apache.org/proper/commons-codec/changes.html). The vendor advisory states that the doFinalize behaviour itself is unchanged (mail-archive.com).
    • httpd 2.4.70: the fixes are PR 70298 (mod_dav_lock, by Arturo Bernal) and PR 66034 (mod_substitute, by Rüdiger Pümml) (linuxcompatible.org). The release is published on httpd.apache.org/download.cgi.

    Remediation

    • Upgrade Apache Commons Codec to 1.23.0 or later (Maven coordinates commons-codec:commons-codec).
    • Search the code for more than one doFinalize call on the same Blake3 instance. Replace those calls with a single call that requests the combined key length, then split the output. Upgrading alone does not fix this code (mail-archive.com).
    • Where the application builds Git trees from archive entries or caller-supplied names, treat CVE-2026-124077 as applicable. Libraries such as Commons Codec often sit deep in dependency trees, so check transitive dependencies too (securityonline.info).
    • Upgrade Apache HTTP Server to 2.4.70 (httpd.apache.org/download.cgi).

    Conflicting Reports

    • The article lists the highest severity as "Awaiting analysis". Apache's own advisory rates CVE-2026-124077 as low (mail-archive.com), and CVE-2026-119078 has no CVSS score yet (strix.ai, radar.offseq.com).
    • The article calls CVE-2026-124077 a flaw with 1.23.0 as the fix and the commit as a second fixed reference. The CVE record also lists the commit hash as a fixed version, so the two references are consistent (cve.threatint.com).
    • Release dates differ: the Apache changes page gives 1.23.0 as 2026-10-04, while Maven Central lists 1.23.0 on Oct 12, 2026 (mvnrepository.com).