UBUNTU-CVE-2026-124077: Medium severity ubuntu/libcommons-codec-java vulnerability
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID. The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed. This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0. Users are recommended to upgrade to version 1.23.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Commons Codecto a version that resolves this vulnerability.Fixed in 1.23.0
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications that construct Git trees from externally supplied names are exposed, including names from archive formats that allow NUL bytes, such as ZIP, or names passed directly to the API. Trees created by walking a normal file system are not affected because common file systems do not permit NUL bytes in file names.
What does an attacker need to exploit the issue?
An attacker would need to cause the application to build a tree using an entry name containing a NUL byte. This can make two distinct directory trees serialize identically and receive the same Git tree identifier or SWHID.
What versions are affected and what is the fix?
Apache Commons Codec versions from 1.22.0 before 1.23.0 are affected. Upgrade to version 1.23.0, which rejects NUL bytes in tree entry names.