{"id":"CVE-2022-42920","aliases":["ALSA-2023:0005","AZL-109475","CLSA-2026-1794293345","CLSA-2026-1794293944","CLSA-2026-1794294951","DEBIAN-CVE-2022-42920","EUVD-2022-7295","GHSA-97xg-phpr-rg8q","RHSA-2022:8958","RHSA-2022:8959","RHSA-2023:0004","RHSA-2023:0005","RLSA-2023:0005","SUSE-SU-2022:4306-1","SUSE-SU-2022:4331-1","UBUNTU-CVE-2022-42920","USN-7208-1","openSUSE-SU-2024:12498-1","openSUSE-SU-2024:12530-1"],"status":"published","title":"Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing","description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03501,"percentile":0.89256,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2022-11-07T00:00:00Z","modified":"2026-11-10T13:15:05Z","fixes":[{"ecosystem":"Maven","package":"org.apache.bcel:bcel","fixed_in":["6.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:9","package":"bcel","fixed_in":["6.4.1-9.el9_1"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.bcel:bcel","fixed_in":["6.4.1-tuxcare.1","6.0-tuxcare.1","6.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"bcel","fixed_in":["6.5.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bcel","fixed_in":["6.5.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bcel","fixed_in":["6.5.0-2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bcel","fixed_in":["0:5.2-19.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bcel-javadoc","fixed_in":["0:5.2-19.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bcel","fixed_in":["0:5.2-19.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bcel-javadoc","fixed_in":["0:5.2-19.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bcel","fixed_in":["0:5.2-19.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bcel-javadoc","fixed_in":["0:5.2-19.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bcel","fixed_in":["0:5.2-19.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bcel-javadoc","fixed_in":["0:5.2-19.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-maven36-bcel","fixed_in":["0:6.3.1-2.3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-maven36-bcel-javadoc","fixed_in":["0:6.3.1-2.3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"bcel","fixed_in":["0:6.4.1-9.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bcel","fixed_in":["0:6.4.1-9.el9_1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"bcel","fixed_in":["0:6.4.1-9.el9_1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"bcel","fixed_in":["5.2-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"bcel","fixed_in":["5.2-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"bcel","fixed_in":["5.2-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"bcel","fixed_in":["5.2-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"bcel","fixed_in":["5.2-28.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"bcel","fixed_in":["5.2-28.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bcel","fixed_in":["6.0~rc3-2ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bcel","fixed_in":["6.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bcel","fixed_in":["6.4.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bcel","fixed_in":["6.5.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"bcel","fixed_in":["5.2-37.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.bcel:bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.1-9.el9_1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2-37"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.bcel:bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.1"},{"fixed":"6.4.1-tuxcare.1"}]}],"versions":["6.4.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.bcel:bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"6.0-tuxcare.1"}]}],"versions":["6.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.bcel:bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3"},{"fixed":"6.3-tuxcare.1"}]}],"versions":["6.3"]},{"source":"osv","ecosystem":"Debian:12","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.bcel:bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0"}]}],"versions":["5.2","6.0","6.1","6.2","6.3","6.3.1","6.4.0","6.4.1","6.5.0"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-19.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bcel-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-19.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-19.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bcel-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-19.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-19.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bcel-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-19.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-19.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bcel-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-19.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-maven36-bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.3.1-2.3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-maven36-bcel-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.3.1-2.3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.1-9.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.1-9.el9_1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.1-9.el9_1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-28.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-28.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0~rc3-2ubuntu1+esm1"}]}],"versions":["6.0~rc3-1ubuntu1","6.0~rc3-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-1ubuntu0.1~esm1"}]}],"versions":["6.0-1","6.1-1","6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.1-1ubuntu0.1~esm1"}]}],"versions":["6.3-1","6.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1ubuntu0.1"}]}],"versions":["6.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0~rc3-2ubuntu1+esm1"}]}],"versions":["6.0~rc3-1ubuntu1","6.0~rc3-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-1ubuntu0.1~esm1"}]}],"versions":["6.0-1","6.1-1","6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.1-1ubuntu0.1~esm1"}]}],"versions":["6.3-1","6.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1ubuntu0.1"}]}],"versions":["6.5.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-37.1"}]}]}],"products":[{"vendor":"apache","product":"commons_bcel"},{"vendor":"apache software foundation","product":"apache commons bcel"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4","tags":["x_transferred","Mailing List","Vendor Advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2022/11/07/2","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202401-25","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42920","tags":["web","advisory"]},{"url":"https://github.com/apache/commons-bcel/pull/147","tags":["web","report"]},{"url":"https://issues.apache.org/jira/browse/BCEL-363","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ/"},{"url":"https://github.com/advisories/GHSA-97xg-phpr-rg8q"},{"url":"https://access.redhat.com/errata/RHSA-2023:0005","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42920","tags":["report"]},{"url":"https://bugzilla.redhat.com/2142707","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-0005.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42920.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-42920","tags":["advisory"]},{"url":"https://github.com/apache/commons-bcel","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8958","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142707","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8958.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42920","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8959","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8959.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0004","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0004.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0005.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0005","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224306-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205125","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42920","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224331-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-42920","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2022/11/04/6","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2022/11/04/8","tags":["report"]},{"url":"https://github.com/apache/commons-bcel/commit/f3267cbcc900f80851d561bdd16b239d936947f5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7208-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-42920","title":"Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing","description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","status":"published","published":"2022-11-07T00:00:00Z","modified":"2024-08-03T13:19:05.457Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-7295","description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","status":"published","published":"2022-11-07T00:00:00Z","modified":"2024-08-03T13:19:05Z","updated_at":"2026-11-03T03:25:19.130756Z"}],"ghsa":[{"id":"GHSA-97xg-phpr-rg8q","title":"Apache Commons BCEL vulnerable to out-of-bounds write","description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","status":"published","published":"2022-11-07T19:00:22Z","modified":"2024-01-19T19:41:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:37:31.550603Z"}],"nvd":[{"id":"CVE-2022-42920","description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","status":"published","published":"2022-11-07T13:15:10.27Z","modified":"2026-06-17T05:05:35.453Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:31.504574Z"}],"osv":[{"id":"AZL-109475","title":"CVE-2022-42920 affecting package bcel 5.2-37","description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","status":"published","published":"2022-11-07T13:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"GHSA-97xg-phpr-rg8q","title":"Apache Commons BCEL vulnerable to out-of-bounds write","description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","status":"published","published":"2022-11-07T19:00:22Z","modified":"2024-02-16T08:05:16.735617Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"RHSA-2022:8958","title":"Red Hat Security Advisory: bcel security update","status":"published","published":"2024-09-13T21:04:37Z","modified":"2026-10-02T10:02:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8959","title":"Red Hat Security Advisory: rh-maven36-bcel security update","status":"published","published":"2024-09-13T21:04:30Z","modified":"2026-10-02T10:02:23Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0004","title":"Red Hat Security Advisory: bcel security update","status":"published","published":"2024-09-13T21:04:47Z","modified":"2026-10-02T10:02:26Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0005","title":"Red Hat Security Advisory: bcel security update","status":"published","published":"2024-09-13T21:04:37Z","modified":"2026-10-02T10:02:27Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2023:0005","title":"Important: bcel security update","description":"The Byte Code Engineering Library (Apache Commons BCEL) is intended to give users a convenient way to analyze, create, and manipulate (binary) Java class files (those ending with .class).\n\nSecurity Fix(es):\n\n* Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing (CVE-2022-42920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-02T06:07:03Z","modified":"2026-02-05T12:15:07.531145Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-42920","description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","status":"published","published":"2022-11-07T13:15:00Z","modified":"2026-02-04T02:17:35.389915Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"ALSA-2023:0005","title":"Important: bcel security update","description":"The Byte Code Engineering Library (Apache Commons BCEL) is intended to give users a convenient way to analyze, create, and manipulate (binary) Java class files (those ending with .class).\n\nSecurity Fix(es):\n\n* Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing (CVE-2022-42920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-02T00:00:00Z","modified":"2026-10-29T11:31:22.271372779Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2026-1794293345","title":"TuxCare security update for org.apache.bcel:bcel (1 CVE)","description":"TuxCare rebuilt org.apache.bcel:bcel to address 1 CVE. Fixed in 6.4.1-tuxcare.1.","status":"published","published":"2026-11-10T07:49:05Z","modified":"2026-11-10T13:15:02.390718501Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"CLSA-2026-1794293944","title":"TuxCare security update for org.apache.bcel:bcel (1 CVE)","description":"TuxCare rebuilt org.apache.bcel:bcel to address 1 CVE. Fixed in 6.0-tuxcare.1.","status":"published","published":"2026-11-10T07:59:05Z","modified":"2026-11-10T13:15:05.415056328Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"CLSA-2026-1794294951","title":"TuxCare security update for org.apache.bcel:bcel (1 CVE)","description":"TuxCare rebuilt org.apache.bcel:bcel to address 1 CVE. Fixed in 6.3-tuxcare.1.","status":"published","published":"2026-11-10T08:15:52Z","modified":"2026-11-10T13:15:02.407772425Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"CVE-2022-42920","title":"Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing","description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","status":"published","published":"2022-11-07T00:00:00Z","modified":"2026-10-28T02:31:11.421567359Z","cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"DEBIAN-CVE-2022-42920","description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","status":"published","published":"2022-11-07T13:15:10.27Z","modified":"2026-11-03T06:02:59.10777083Z","updated_at":"2026-11-03T06:43:01.507088Z"},{"id":"openSUSE-SU-2024:12498-1","title":"bcel5_3-5.3-21.1 on GA media","description":"These are all security issues fixed in the bcel5_3-5.3-21.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:22:10.391284Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12530-1","title":"bcel-5.2-37.1 on GA media","description":"These are all security issues fixed in the bcel-5.2-37.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:38:01.577082Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:4306-1","title":"Security update for bcel","description":"This update for bcel fixes the following issues:\n\n- CVE-2022-42920: Fixed producing arbitrary bytecode via out-of-bounds writing (bsc#1205125).\n","status":"published","published":"2022-12-01T08:27:18Z","modified":"2026-02-04T04:26:43.98257Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2022:4331-1","title":"Security update for bcel","description":"This update for bcel fixes the following issues:\n\n- CVE-2022-42920: Fixed producing arbitrary bytecode via out-of-bounds writing (bsc#1205125).\n","status":"published","published":"2022-12-06T12:34:27Z","modified":"2026-02-04T02:15:50.550808Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-7208-1","title":"bcel vulnerability","description":"Felix Wilhelm discovered that Apache Commons BCEL APIs\nincorrectly handled parameters due to a memory issue. An\nattacker supplying malicious input could exploit this to\ngenerate and execute arbitrary bytecode.\n","status":"published","published":"2025-01-16T12:40:24Z","modified":"2026-06-25T13:32:30.384145167Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}