Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by apache

CVE-2026-94114Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Medium 5.9

In plain English

A medium-severity security flaw in Apache Commons BCEL from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 79.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12bcelno fix listedDEBIAN-CVE-2026-94114
Debian:13bcelno fix listedDEBIAN-CVE-2026-94114
Debian:14bcel6.13.0-1DEBIAN-CVE-2026-94114
Ubuntu:22.04:LTSbcelno fix listedUBUNTU-CVE-2026-94114
Ubuntu:24.04:LTSbcelno fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.04:LTSbcelno fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.10bcelno fix listedUBUNTU-CVE-2026-94114
Ubuntu:22.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-94114
Ubuntu:24.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.10openjdk-17no fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.04:LTSopenjdk-17-cracno fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.10openjdk-17-cracno fix listedUBUNTU-CVE-2026-94114
Ubuntu:22.04:LTSopenjdk-18no fix listedUBUNTU-CVE-2026-94114
Ubuntu:22.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-94114
Ubuntu:24.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.10openjdk-21no fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.04:LTSopenjdk-21-cracno fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.10openjdk-21-cracno fix listedUBUNTU-CVE-2026-94114
Ubuntu:22.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-94114
Ubuntu:24.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.10openjdk-25no fix listedUBUNTU-CVE-2026-94114
Ubuntu:22.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-94114
Ubuntu:24.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.10openjdk-8no fix listedUBUNTU-CVE-2026-94114
Ubuntu:22.04:LTSopenjdk-ltsno fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.04:LTSopenjdk-ltsno fix listedUBUNTU-CVE-2026-94114
Ubuntu:26.10openjdk-ltsno fix listedUBUNTU-CVE-2026-94114

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Commons BCEL 0 – before 6.13.00 – before 14890bf2b9014df25f9b4de86f29b5e917e5656b

Weakness: CWE-386 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References