CVE-2026-105111

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.

This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).

This issue affects Apache Commons BCEL: before 6.13.0.

Users are recommended to upgrade to version 6.13.0, which fixes the issue.

These are all security issues fixed in the bcel-6.13.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for bcel fixes the following issues:

• CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400).
• CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399).

Changes for bcel:

• Update to version 6.13.0

• New Features

• Add support for permitted subclasses
• Add RecordComponentInfo.getAttribute(byte tag)
• Add Const.MAJOR_27
• Add Const.MINOR_27
• Add and use ArrayType.isElementType(Type)
• Add Const.MAJOR_28
• Add Const.MINOR_28

• Fixed Bugs

• Fix constant pool module access test on Java 26 and above
• Deprecate org.apache.bcel.classfile.Utility.Utility()
• Deprecate org.apache.bcel.verifier.exc.Utility .getStackTrace(Throwable)
• Fix all Javadoc warnings and enforce checks by default
• Escape constant pool names in generated HTML
• Escape referenced names in BCELFactory Java output
• Make wide flag thread-local in Utility.codeToString
• Read multianewarray dimensions as unsigned byte
• Site docs: clarify security model
• Read ConstantDynamic indices as unsigned shorts
• Validate index upper bound in CPInstruction, IINC and RET setIndex
• Use correct attribute tag in NestHost and ModuleMainClass
• Propagate runtime-visible flag when parsing parameter annotations
• Use fixedLength for parsed LOOKUPSWITCH length
• Fix ConstantPoolGen dedup key collisions for names with delimiters
• Read unsigned bytecode operands in CodeHTML disassembler
• Deep-copy bootstrap arguments array in BootstrapMethod.copy()
• Use exclusive live-range end in LocalVariableTable .getLocalVariable
• Build TABLESWITCH from sorted arrays in SWITCH
• Use array element type not basic type for primitive array access
• Set length in INVOKEDYNAMIC constructor
• Reject CALOAD on non-char arrays in structural verification
• Add negative verifier tests for remaining array load/store component type checks
• Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY
• Match wide local variable instruction length to dumped bytes
• Bound IINC increment to signed short
• Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8
• Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser
• Nested annotation element values recurse unboundedly; MAX_ARRAY_DIMENSIONS cap bypassed
• Opcodes tableswitch and lookupswitch add boundary checks
• JustIce Pass 2 hangs on cyclic superclass chain of a referenced exception class
• JustIce Pass 2 LVT check amplifies each 10-byte entry into ~131k hashtable operations
• Pass 3b dataflow stores frames per instruction and clones ever-growing execution chains
• Cubic handlers * range * subroutines scan in Subroutines constructor hangs JustIce Pass 3b
• Subroutines.noRecursiveCalls enumerates exponentially many JSR call paths
• Disassembler and Class2HTML re-implement the unchecked switch-table allocation
• ConstantPool.constantToString recurses forever on self-referencing CONSTANT_MethodHandle
• Utility.typeSignatureToString recurses per generic-nesting level, unbounded, with quadratic substring copies
• Repositories cache classes under the input-defined this_class name; global static Repository/VerifierFactory make the poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114)
• Silent u2/u1 count truncation across dump paths corrupts emitted bytecode
• Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports) (bsc#1284399, CVE-2026-105111)
• Class2HTML builds output file paths from the unvalidated class name
• ClassPath.getBytes() sizes its buffer from the forged ZIP uncompressed-size field
• PMG attribute ignores declared length, enabling BCEL-vs-JVM parse divergence
• Signature.matchGJIdent recurses unboundedly on nested generic signatures (Signature.translate)
• Utility.decode fixed 3x buffer breaks the encode/decode round trip and throws unchecked AIOOBE
• BCELifier interpolates…

This update for bcel fixes the following issues:

• CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400).
• CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399).

Changes for bcel:

• Update to version 6.13.0

• New Features

• Add support for permitted subclasses
• Add RecordComponentInfo.getAttribute(byte tag)
• Add Const.MAJOR_27
• Add Const.MINOR_27
• Add and use ArrayType.isElementType(Type)
• Add Const.MAJOR_28
• Add Const.MINOR_28

• Fixed Bugs

• Fix constant pool module access test on Java 26 and above
• Deprecate org.apache.bcel.classfile.Utility.Utility()
• Deprecate org.apache.bcel.verifier.exc.Utility .getStackTrace(Throwable)
• Fix all Javadoc warnings and enforce checks by default
• Escape constant pool names in generated HTML
• Escape referenced names in BCELFactory Java output
• Make wide flag thread-local in Utility.codeToString
• Read multianewarray dimensions as unsigned byte
• Site docs: clarify security model
• Read ConstantDynamic indices as unsigned shorts
• Validate index upper bound in CPInstruction, IINC and RET setIndex
• Use correct attribute tag in NestHost and ModuleMainClass
• Propagate runtime-visible flag when parsing parameter annotations
• Use fixedLength for parsed LOOKUPSWITCH length
• Fix ConstantPoolGen dedup key collisions for names with delimiters
• Read unsigned bytecode operands in CodeHTML disassembler
• Deep-copy bootstrap arguments array in BootstrapMethod.copy()
• Use exclusive live-range end in LocalVariableTable .getLocalVariable
• Build TABLESWITCH from sorted arrays in SWITCH
• Use array element type not basic type for primitive array access
• Set length in INVOKEDYNAMIC constructor
• Reject CALOAD on non-char arrays in structural verification
• Add negative verifier tests for remaining array load/store component type checks
• Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY
• Match wide local variable instruction length to dumped bytes
• Bound IINC increment to signed short
• Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8
• Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser
• Nested annotation element values recurse unboundedly; MAX_ARRAY_DIMENSIONS cap bypassed
• Opcodes tableswitch and lookupswitch add boundary checks
• JustIce Pass 2 hangs on cyclic superclass chain of a referenced exception class
• JustIce Pass 2 LVT check amplifies each 10-byte entry into ~131k hashtable operations
• Pass 3b dataflow stores frames per instruction and clones ever-growing execution chains
• Cubic handlers * range * subroutines scan in Subroutines constructor hangs JustIce Pass 3b
• Subroutines.noRecursiveCalls enumerates exponentially many JSR call paths
• Disassembler and Class2HTML re-implement the unchecked switch-table allocation
• ConstantPool.constantToString recurses forever on self-referencing CONSTANT_MethodHandle
• Utility.typeSignatureToString recurses per generic-nesting level, unbounded, with quadratic substring copies
• Repositories cache classes under the input-defined this_class name; global static Repository/VerifierFactory make the poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114)
• Silent u2/u1 count truncation across dump paths corrupts emitted bytecode
• Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports) (bsc#1284399, CVE-2026-105111)
• Class2HTML builds output file paths from the unvalidated class name
• ClassPath.getBytes() sizes its buffer from the forged ZIP uncompressed-size field
• PMG attribute ignores declared length, enabling BCEL-vs-JVM parse divergence
• Signature.matchGJIdent recurses unboundedly on nested generic signatures (Signature.translate)
• Utility.decode fixed 3x buffer breaks the encode/decode round trip and throws unchecked AIOOBE
• BCELifier interpolates…