Inconsistent Output Issue in Apache Commons Codec's Blake3 Class

CVE-2026-119078

What is CVE-2026-119078?

The Blake3 class in Apache Commons Codec has a significant inconsistency between its documentation and actual functionality. The doFinalize method was documented to change its output based on previously finalized bytes, suggesting that multiple calls would yield different results. However, it has been found that the method does not alter the hash state, resulting in the same output when called without new input. This documentation gap can lead to developers deriving identical keys through consecutive doFinalize calls, contradicting their expectations and compromise the integrity of derived key separation. Users should review their implementation to ensure they are following proper key-derivation practices as outlined in the updated Javadoc, especially since upgraded versions alone do not resolve this issue.

References