The GitIdentifiers class of Apache Commons Codec accepts NUL bytes in tree entry names. Because Git delineates tree entries with NUL bytes, a crafted name can cause two distinct directory trees to serialize to identical byte sequences, resulting in the same Git tree identifier or SWHID. The weakness is classified as CWE-158. This collision can lead to confusion or integrity problems in systems that rely on unique tree identifiers, but it does not provide arbitrary code execution or privilege escalation.

Apache Commons Codec versions beginning with 1.22.0 and prior to 1.23.0 are vulnerable. The affected releases are distributed by the Apache Software Foundation.

The vulnerability has no CVSS score and EPSS is not available, indicating no quantified risk metric. It is not listed in CISA KEV, suggesting no known exploits. The likely attack vector is code that constructs tree objects from user‑supplied names, such as processing archive files that allow NUL bytes or application API calls that accept arbitrary names. An attacker would need to control the input names; the impact is limited to identifier collisions rather than remote code execution. The practical threat is primarily to systems that depend on accurate Git tree hashes for identification or integrity.