6 matches found
CVE-2026-119078
Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again without supplying more input returns th...
EUVD-2026-120400
Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again without supplying more input returns th...
CVE-2026-119078 Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys
Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again without supplying more input returns th...
CVE-2026-119078
The Apache Commons Codec library (versions 1.16.0 through 1.22.x) contains a logic flaw in the Blake3 class. While the documentation suggests that consecutive calls to the doFinalize method return different outputs, the method does not actually change the hash state, resulting in identical output...
PT-2026-141103
Name of the Vulnerable Software and Affected Versions Apache Commons Codec versions 1.16.0 through 1.22.x Description The doFinalize function in the Blake3 class is stateless, meaning it does not change the hash state when called. Consequently, consecutive calls to this function without providing...
CVE-2026-119078: Apache Software Foundation Apache Commons Codec: Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously…
Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again without supplying more input returns th...