EN PT-BR
← Voltar ao feed
medium

Apache HTTP Server 2.4.70 fixes unspecified flaws without CVEs; Apache Commons Codec 1.23.0 patches CVE-2026-119078 and CVE-2026-124077

2 fonte(s) · 2 atualização(ões) · publicado 08/11/2026 21:00 · coletado há 11 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 10/11/2026 12:20; os links antigos trazem para cá.

Fontes: securityonline.info ↗ cert.cyber.gouv.fr ↗

The Apache Software Foundation released Apache HTTP Server 2.4.70 on 6 November 2026. CERT-FR (cert.cyber.gouv.fr) published notice CERTFR-2026-AVI-1484 on 9 November, reporting multiple vulnerabilities of unspecified impact in all earlier 2.4.x versions. The notice names no CVE, attack vector or CVSS score. Later reporting (securityonline.info) says the release fixes a heap buffer overflow in mod_dav_lock and an integer overflow in mod_substitute, but no CVEs have been assigned. On 9 November 2026 the Apache Software Foundation also disclosed two flaws in Apache Commons Codec, CVE-2026-119078 and CVE-2026-124077, both fixed in 1.23.0. No exploitation or public exploit has been reported for any of these issues. The security relevance of the httpd fixes remains unconfirmed by the vendor security page, and the CERT-FR criticity is rated medium.

Entenda a falha

A vulnerabilidade

Two flaws in Apache Commons Codec, both fixed in 1.23.0. CVE-2026-119078 (CWE-684, CWE-1068) is in the Blake3 class: the Javadoc said repeated doFinalize calls return new output, but they return the same bytes. The key-derivation example shipped since 1.16.0 therefore yields identical keys and loses key separation. Affected: 1.16.0 up to before 1.23.0; no CVSS score has been published. CVE-2026-124077 (CWE-158) is in GitIdentifiers (1.22.0 up to before 1.23.0): it accepted NUL bytes in tree entry names, so two different trees can get the same Git tree ID or SWHID. Apache rates it low. Only apps that build trees from archive entries or caller-supplied names are exposed. Separately, httpd 2.4.70 (2.4.69 and earlier affected) fixes a heap buffer overflow in mod_dav_lock and an integer overflow in mod_substitute, with no CVEs assigned. No exploitation has been reported.

Como funciona

For CVE-2026-119078, a developer follows the Blake3 documentation and example: create one Blake3 instance in key-derivation mode, feed it input, then call doFinalize twice to get two keys. Because doFinalize does not advance the hash state, the second call with no new input returns the same bytes as the first, so both keys are identical. For CVE-2026-124077, an application passes entry names, for example from a ZIP archive, to GitIdentifiers to compute a Git tree ID. Git ends each entry name at a NUL byte, so a name containing NUL serializes to the same bytes as a different tree, and both get the same ID. Trees read from disk are unaffected because common file systems forbid NUL in names.

Por que é vulnerável

CVE-2026-119078 is a documentation and example error: the Javadoc described doFinalize as producing new output on each call, which is not how it behaves, and the doFinalize behaviour itself is unchanged. The 1.23.0 fix is documentation only, so upgrading does not repair code that already calls doFinalize repeatedly; the advice is to request the combined key length in one call and split the output. CVE-2026-124077 is a missing input check: GitIdentifiers did not reject NUL bytes in tree entry names, which Git treats as terminators. The fix rejects empty and ambiguous entry names and file/directory name conflicts. For the httpd bug in mod_dav_lock, the reports say space for a key length was under-reserved; no CVE or further root cause is given.

Onde está

In apache/commons-codec: the Blake3 class (Javadoc and key-derivation example) and the GitIdentifiers class; the CVE-2026-124077 fix is commit 87f6aa2818836998528ff4b0d1ea35545a800ee5, "Reject ambiguous GitIdentifiers tree entry names". In httpd, the heap overflow is in dav_size_indirect() of mod_dav_lock.

Como foi descoberta

The articles do not say who found any of these flaws or how. The Apache Software Foundation disclosed both Commons Codec CVEs on 9 November 2026. A mirror fork shows the fix commit by garydgregory dated 18 September 2026; the upstream pull request and merge date were not confirmed. For httpd, 2.4.70 was released on 6 November 2026, and CERT-FR (notice CERTFR-2026-AVI-1484, 9 November) reported unspecified vulnerabilities with no CVE. The overflow details come from later press reports, and the vendor security page has no 2.4.70 entry. No exploitation has been reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 12:36.

Detalhes técnicos

  • Apache HTTP Server 2.4.70: the heap buffer overflow is in dav_size_indirect() of mod_dav_lock, which under-reserved space for a key length. The integer overflow in mod_substitute appears only in specific configurations (securityonline.info, pbxscience.com, codeit.guru, linuxcompatible.org). Other fixes reported are crash fixes in mod_authnz_ldap and edge-case fixes in mod_cgid and mod_cache (linuxcompatible.org). No CVE, CVSS score, prerequisite or exploitation status was found for any of them.
  • CVE-2026-119078 (CWE-684, CWE-1068), Commons Codec Blake3: the Javadoc said repeated doFinalize calls on one instance return new output. In fact the call does not advance the hash state, so a repeat call with no new input returns the same bytes. The key-derivation example shipped since 1.16.0 makes two such calls, so its derived keys are identical and key separation is lost. The affected range is 1.16.0 up to but not including 1.23.0 (mail-archive.com, cve.threatint.com, radar.offseq.com). No CVSS score was published.
  • CVE-2026-124077 (CWE-158), Commons Codec GitIdentifiers: NUL bytes were accepted in tree entry names. Git ends an entry name at a NUL byte, so two different directory trees can serialize to the same bytes and get the same Git tree ID or SWHID. Common file systems forbid NUL in names, so trees walked from disk are unaffected. Exposure is limited to trees built from archive entries such as ZIP, or from names passed directly to the API. The affected range is 1.22.0 before 1.23.0, plus the Git-branch range from commit 387120c901f4a75c3112dfdf8877dcdec7ae685d before 87f6aa2818836998528ff4b0d1ea35545a800ee5. Apache rates the severity low (mail-archive.com, strix.ai).
  • Fix for CVE-2026-124077: commit 87f6aa2818836998528ff4b0d1ea35545a800ee5 in apache/commons-codec, titled "Reject ambiguous GitIdentifiers tree entry names". It rejects empty and ambiguous tree entry names and file/directory name conflicts. A mirror fork shows commits by garydgregory dated 18 September 2026. The upstream pull-request number and merge date were not confirmed (securityonline.info).
  • Fix for CVE-2026-119078: the 1.23.0 change is documentation only, so upgrading does not repair code that already derives keys by calling doFinalize repeatedly (securityonline.info).

Remediação

  • Upgrade Apache HTTP Server to 2.4.70 or later, as named in the CERT-FR notice. Review the CHANGES_2.4.70 changelog for the authoritative list of changes.
  • Check whether mod_dav_lock (WebDAV) and mod_substitute are enabled in your configurations, to prioritize patching.
  • Upgrade Apache Commons Codec to 1.23.0 or later.
  • Audit code that derives keys with Blake3 by calling doFinalize repeatedly on one instance. Rework it so each key is derived from distinct input, because the upgrade does not change the behaviour. Keys already derived this way should be treated as non-separated and regenerated.
  • Where GitIdentifiers is fed archive entries or caller-supplied names, validate that names contain no NUL bytes. Do not rely on tree IDs or SWHIDs for such input before upgrading.

Relatos divergentes

  • Existence of vulnerabilities in httpd: CERT-FR (cert.cyber.gouv.fr, 9 November) reports multiple vulnerabilities in releases before 2.4.70. A news report (linuxcompatible.org, 6 November) says 2.4.70 carries no new CVEs and is a bug-fix and hardening release. The Apache security page (httpd.apache.org) has no 2.4.70 entry; its newest entry is 2.4.69, released 1 October 2026, listing 20 CVEs. The later securityonline.info report (10 November) describes memory-corruption fixes that were assigned no CVEs. This is consistent with the absence of an advisory, but the vendor changelog remains the authoritative source and could not be opened.
  • Impact: CERT-FR gives no impact, while securityonline.info, pbxscience.com and codeit.guru describe specific overflow bugs. Whether they are exploitable is not established.

Linha do tempo

  1. securityonline.info ↗ · pub. 10/11/2026 01:04 · coletado 10/11 02:00

    Apache Commons Codec Blake3 KDF and Git tree ID flaws patched in 1.23.0; httpd 2.4.70 fixes memory bugs

    ler a análise desta fonte

    The Apache Software Foundation disclosed two flaws in Apache Commons Codec on November 9, 2026: CVE-2026-119078, a Blake3 doFinalize behaviour that the documentation misdescribed, and CVE-2026-124077, a NUL-byte handling gap in GitIdentifiers (github.com/apache/commons-codec/commit/87f6aa2818836998528ff4b0d1ea35545a800ee5.patch, lists.apache.org, cve.threatint.com). Both are fixed in 1.23.0, but the Blake3 fix is documentation only, so upgrading does not repair code that already derives keys by calling doFinalize repeatedly. The Apache-supplied severity for CVE-2026-124077 is low, and no CVSS score was published for CVE-2026-119078 (mail-archive.com, strix.ai). No exploitation or public exploit has been reported. Separately, Apache HTTP Server 2.4.70, released November 6, 2026, fixes a heap buffer overflow in mod_dav_lock and an integer overflow in mod_substitute without assigning CVEs (httpd.apache.org/download.cgi, pbxscience.com, linuxcompatible.org).

    Technical Details

    • CVE-2026-119078 (CWE-684, CWE-1068): the Blake3 Javadoc said repeated doFinalize calls on one instance return new output. In fact the call does not advance the hash state, so calling it again with no new input returns the same bytes. The key-derivation example shipped since 1.16.0 makes two such calls, so its derived keys are identical and their separation is lost. The affected range is 1.16.0 before 1.23.0 (mail-archive.com, cve.threatint.com, radar.offseq.com).
    • CVE-2026-124077 (CWE-158): GitIdentifiers accepted NUL bytes in tree entry names. Git ends each entry name at a NUL byte, so two different directory trees can serialize to the same bytes and receive the same Git tree ID or SWHID. Common file systems forbid NUL in names, so trees walked from disk are unaffected; the exposure is limited to trees built from archive entries such as ZIP or from names passed directly to the API. The affected range is 1.22.0 before 1.23.0, plus the Git-branch range from 387120c901f4a75c3112dfdf8877dcdec7ae685d before 87f6aa2818836998528ff4b0d1ea35545a800ee5 (mail-archive.com, strix.ai).
    • Apache HTTP Server 2.4.70: the release fixes a heap buffer overflow in dav_size_indirect() of mod_dav_lock, which under-reserved space for a key length, and an integer overflow in mod_substitute that appears only in specific configurations. The release also addresses other issues but assigns no CVE to any of them (linuxcompatible.org, pbxscience.com, codeit.guru).

    Fix Details

    • CVE-2026-124077: the fix is commit 87f6aa2818836998528ff4b0d1ea35545a800ee5 in apache/commons-codec. A mirror fork's pull-request page (github.com/johnperez416/commons-codec/pull/204) shows the commit titled "Reject ambiguous GitIdentifiers tree entry names", with commits by garydgregory dated September 18, 2026. The upstream pull-request number and merge date were not confirmed. The change rejects empty and ambiguous tree entry names and file/directory name conflicts (commons.apache.org/proper/commons-codec/changes.html). The fix ships in 1.23.0, listed in the changes page as released 2026-10-04 (commons.apache.org, mvnrepository.com).
    • CVE-2026-119078: the 1.23.0 changes page lists "Fix Blake3 KDF example and clarify finalization semantics" (commons.apache.org/proper/commons-codec/changes.html). The vendor advisory states that the doFinalize behaviour itself is unchanged (mail-archive.com).
    • httpd 2.4.70: the fixes are PR 70298 (mod_dav_lock, by Arturo Bernal) and PR 66034 (mod_substitute, by Rüdiger Pümml) (linuxcompatible.org). The release is published on httpd.apache.org/download.cgi.

    Remediation

    • Upgrade Apache Commons Codec to 1.23.0 or later (Maven coordinates commons-codec:commons-codec).
    • Search the code for more than one doFinalize call on the same Blake3 instance. Replace those calls with a single call that requests the combined key length, then split the output. Upgrading alone does not fix this code (mail-archive.com).
    • Where the application builds Git trees from archive entries or caller-supplied names, treat CVE-2026-124077 as applicable. Libraries such as Commons Codec often sit deep in dependency trees, so check transitive dependencies too (securityonline.info).
    • Upgrade Apache HTTP Server to 2.4.70 (httpd.apache.org/download.cgi).

    Conflicting Reports

    • The article lists the highest severity as "Awaiting analysis". Apache's own advisory rates CVE-2026-124077 as low (mail-archive.com), and CVE-2026-119078 has no CVSS score yet (strix.ai, radar.offseq.com).
    • The article calls CVE-2026-124077 a flaw with 1.23.0 as the fix and the commit as a second fixed reference. The CVE record also lists the commit hash as a fixed version, so the two references are consistent (cve.threatint.com).
    • Release dates differ: the Apache changes page gives 1.23.0 as 2026-10-04, while Maven Central lists 1.23.0 on Oct 12, 2026 (mvnrepository.com).
  2. cert.cyber.gouv.fr ↗ · pub. 08/11/2026 21:00 · coletado 09/11 14:01 primeiro registro

    Apache HTTP Server 2.4.70 fixes multiple vulnerabilities with unspecified impact in earlier 2.4.x releases

    ler a análise desta fonte

    The Apache Software Foundation released Apache HTTP Server 2.4.70 on 6 November 2026, and the CERT-FR notice CERTFR-2026-AVI-1484 reports multiple vulnerabilities in all versions prior to 2.4.70, with an impact the vendor did not specify. The notice names no CVE, attack vector, authentication requirement or CVSS score, and it points to the Apache changelog CHANGES_2.4.70 as the vendor bulletin. The Apache security page opened during research has no entry for 2.4.70; its newest entry is 2.4.69, released 1 October 2026, which lists 20 CVEs (httpd.apache.org). A news report on the release says 2.4.70 carries no new CVEs and is a bug-fix and hardening release (linuxcompatible.org), so the security relevance of the fixes is not established by the sources opened and the criticity is medium.

    Technical Details

    • The CERT-FR notice only states that an attacker can cause a security problem that the vendor does not specify (cert.cyber.gouv.fr).
    • The news report describes the 2.4.70 changes as crash fixes in mod_authnz_ldap, overflow fixes in mod_dav_lock, and edge-case fixes in mod_cgid, mod_substitute and mod_cache (linuxcompatible.org). These are not confirmed as security issues by the vendor page opened.
    • No CVE, CVSS score, prerequisite or exploitation status for 2.4.70 was found in the sources opened.

    Remediation

    • Upgrade Apache HTTP Server to 2.4.70 or later, the version the CERT-FR notice names as the fix.
    • Review the changelog CHANGES_2.4.70 linked in the CERT-FR notice for the authoritative list of changes, since the vendor's security page did not list them.
    • Systems still on 2.4.69 or earlier should also check the per-release fix list on the vendor security page (httpd.apache.org).

    Conflicting Reports

    • The CERT-FR notice (cert.cyber.gouv.fr) reports multiple vulnerabilities in releases before 2.4.70 without naming any CVE.
    • The news report (linuxcompatible.org, 6 November 2026) states that 2.4.70 carries no new CVEs.
    • The vendor security page opened during research (httpd.apache.org) has no 2.4.70 entry, which is consistent with the news report. The vendor changelog could not be opened and remains the authoritative source.