Threats affecting pkg:maven/commons-codec/commons-codec

Apache Commons Codec's Blake3 class has a documented behavior mismatch in its doFinalize method. The method's documentation states that consecutive calls to doFinalize would produce different outputs, but in reality, repeated calls without new input return the same output. This affects key derivation processes that rely on multiple doFinalize calls to generate distinct keys, causing them to produce identical keys instead. The issue affects versions from 1.16.0 up to but not including 1.23.0. Version 1.23.0 corrects the documentation but does not change the method's behavior. Users must adjust their code to derive multiple keys correctly by requesting the combined length in a single call and splitting the output.

A vulnerability in Apache Commons Codec versions 1.22.0 up to but not including 1.23.0 allows crafted tree entry names containing NUL bytes to cause different directory trees to serialize to the same Git tree identifier or SWHID. This occurs because the GitIdentifiers class did not reject NUL bytes in tree entry names. The impact is limited since common file systems disallow NUL bytes in file names, so only applications building trees from external sources like archive formats permitting NUL bytes (e.g., ZIP) or direct API input are affected. The issue is fixed in version 1.23.0.