NUL Byte Handling Vulnerability in Apache Commons Codec
CVE-2026-124077

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Commons Codec
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124077?

The GitIdentifiers class in Apache Commons Codec allows NUL bytes in tree entry names, which can lead to serialization issues where different directory trees receive the same identifier due to crafted names. This vulnerability primarily affects applications that build trees from names supplied through external sources or archive formats that permit NUL bytes. Users are advised to upgrade to version 1.23.0 to mitigate the issue.

Affected Version(s)

Apache Commons Codec 1.22.0 < 1.23.0

Apache Commons Codec 387120c901f4a75c3112dfdf8877dcdec7ae685d < 87f6aa2818836998528ff4b0d1ea35545a800ee5

References

https://github.com/apache/commons-codec/commit/87f6aa2818...
patch
https://lists.apache.org/thread.html/zns7tbnkq685prps9d85...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude Security
Gary D. Gregory
.