CVE-2026-124077

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could...

CVE-2026-124077 Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could...

CVE-2026-124077: Apache Software Foundation Apache Commons Codec: The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could...

PT-2026-141105

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could...

[SECURITY] Fedora 45 Update: ocaml-swhid-core-0.1-13.fc45

swhidcore is an OCaml library to work with persistent identifiers used by Software Heritage, also known as swhid. This is the core library; for most use cases you should use the swhid library instead...