Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-94114

Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Commons BCEL

Default version status: unaffected

  • 0 to < 6.13.0affected
  • 0 to < 14890bf2b9014df25f9b4de86f29b5e917e5656baffected
pkg:maven/org.apache.bcel/bcel

References