Apache Commons BCEL caches class files using the class’s declared name without checking that the object matches that name. This allows an attacker to supply a malicious class file whose declared name does not correspond to its actual class type, causing subsequent lookups to return the attacker‑controlled class. Cache poisoning of this nature can lead to the execution of unintended code or other adverse effects if the attacker’s class is later retrieved by an application. The flaw may also result in denial of service if the application relies on cached classes to function correctly.

All versions of Apache Commons BCEL before 6.13.0 are affected. Systems that include this library and parse externally supplied class files are at risk.

The CVSS score of 8.2 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation, and the flaw is not listed in CISA KEV catalog. An attacker would need to send a crafted class file to an application that employs BCEL’s ClassParser. If the application does not verify that the class name matches its declared name, the attacker‑controlled class can be stored in the cache and later retrieved, enabling the execution of malicious code or other unintended behavior.