CVE-2026-94114

MediumCVSS 5.9

Published: 06/10/2026(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

In Apache Commons BCEL before 6.13.0, there is an issue with symbolic name mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.

Risk Assessment

An attacker could exploit this to substitute classes, potentially leading to unauthorized code execution or integrity compromise in applications using BCEL.

Recommendation

Upgrade Apache Commons BCEL to version 6.13.0 or later, which fixes the issue.

Other vulnerabilities in Apache Commons BCEL

CVE-2026-105111Medium
Improper neutralization of input during web page generation ('cross-site scripting') in Apache Commons BCEL. This occurs when using Class2HTML to generate webpages for possibly attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). Affects versions before 6.13.0.

Original NVD description (English source)

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS