Threats tagged 'ghsa-rv28-228v-c565'

Apache Commons Codec's Blake3 class has a documented behavior mismatch where the doFinalize method does not update the hash state, causing repeated calls without new input to return identical output. This affects key derivation scenarios where multiple keys are expected from consecutive doFinalize calls on the same instance, resulting in identical keys and loss of separation between them. The issue affects versions from 1.16.0 before 1.23.0. Version 1.23.0 corrects the documentation but does not change the method's behavior. Users must adjust their code to derive multiple keys by requesting the combined length in a single call and splitting the output accordingly.