The GitIdentifiers class in Apache Commons Codec versions from 1.22.0 before 1.23.0 did not reject NUL bytes in tree entry names. This flaw could cause two different directory trees to serialize to the same Git tree identifier or SWHID if crafted names containing NUL bytes were used. The impact is limited because common file systems disallow NUL bytes in file names, so only applications that build trees from external sources allowing NUL bytes, such as certain archive formats or direct API inputs, are affected. The issue is fixed in version 1.23.0.