Bug 2569974 (CVE-2026-124077)

Summary: CVE-2026-124077 commons-codec/commons-codec: Apache Commons Codec: Identifier collision via unvalidated null bytes in tree entry names
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache Commons Codec. An attacker can provide crafted directory entry names containing null bytes to an application constructing Git tree objects, causing two distinct directory trees to serialize into identical data. Consequently, different trees can receive the same identifier, leading to identifier collisions and data integrity issues in applications relying on unique tree tracking.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 19:28:16 UTC 
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID.



The impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed.



This issue affects Apache Commons Codec: from 1.22.0 before 1.23.0.



Users are recommended to upgrade to version 1.23.0, which fixes the issue.