BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Commons BCEL | unaffected |
|
No data.
No data.
No data available yet.
No remediation available yet.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 06 Oct 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 06 Oct 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Symbolic name not mapping to correct object vulnerability in Apache Commons. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue. | |
| Title | Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser | |
| Weaknesses | CWE-386 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-10-06T19:59:30.889Z
Reserved: 2026-09-20T11:44:30.281Z
Link: CVE-2026-94114
Vulnrichment
Updated: 2026-10-06T19:59:25.963Z
NVD
Status : Received
Published: 2026-10-06T20:17:34.420
Modified: 2026-10-06T20:17:34.420
Link: CVE-2026-94114
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-386
Symbolic Name not Mapping to Correct Object