Riskcovery

CVE-2026-94114

Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

State
Published
Severity
8.2 High
Published
Oct 6, 2026
Updated
Oct 8, 2026
Reserved
Sep 20, 2026

Read the record on cve.org

Description

Symbolic name not mapping to correct class.

BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.

This issue affects Apache Commons BCEL: before 6.13.0.

Users are recommended to upgrade to version 6.13.0, which fixes the issue.

Scores

CVSSScoreVectorSource
4.08.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:Napache
3.15.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:Napache

Weaknesses

  • CWE-386 Symbolic name not mapping to correct object

Affected Products

ProductVersions
Apache Commons BCELApache Software Foundation
  • before 6.13.0Affected
  • before 14890bf2b9014df25f9b4de86f29b5e917e5656bAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.