{"id":"CVE-2026-94114","aliases":["AZL-108017","DEBIAN-CVE-2026-94114","EUVD-2026-93970","GHSA-2p8h-ph4h-rm2f","SUSE-SU-2026:24258-1","UBUNTU-CVE-2026-94114","openSUSE-SU-2026:12080-1","openSUSE-SU-2026:22109-1"],"status":"published","title":"Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning","description":"Symbolic name not mapping to correct class.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00279,"percentile":0.20622,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-386"],"published":"2026-10-06T19:42:30Z","modified":"2026-11-10T02:52:19Z","fixes":[{"ecosystem":"Debian:14","package":"bcel","fixed_in":["6.13.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2-37"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.0-1","6.13.0-1","6.5.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.0-1","6.13.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.0-1"}]}],"versions":["6.10.0-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u66-b01-5","8u72-b05-1ubuntu1","8u72-b05-5","8u72-b05-6","8u72-b15-1","8u72-b15-2ubuntu1","8u72-b15-2ubuntu3","8u72-b15-3ubuntu1","8u77-b03-1ubuntu2","8u77-b03-3ubuntu1","8u77-b03-3ubuntu2","8u77-b03-3ubuntu3","8u91-b14-0ubuntu4~16.04.1","8u91-b14-3ubuntu1~16.04.1","8u111-b14-2ubuntu0.16.04.2","8u121-b13-0ubuntu1.16.04.2","8u131-b11-0ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.3","8u151-b12-0ubuntu0.16.04.2","8u162-b12-0ubuntu0.16.04.2","8u171-b11-0ubuntu0.16.04.1","8u181-b13-0ubuntu0.16.04.1","8u181-b13-1ubuntu0.16.04.1","8u191-b12-0ubuntu0.16.04.1","8u191-b12-2ubuntu0.16.04.1","8u212-b03-0ubuntu1.16.04.1","8u222-b10-1ubuntu1~16.04.1","8u232-b09-0ubuntu1~16.04.1","8u242-b08-0ubuntu3~16.04","8u252-b09-1~16.04","8u265-b01-0ubuntu2~16.04","8u272-b10-0ubuntu1~16.04","8u275-b01-0ubuntu1~16.04","8u282-b08-0ubuntu1~16.04","8u292-b10-0ubuntu1~16.04.1","8u312-b07-0ubuntu1~16.04","8u342-b07-0ubuntu1~16.04","8u352-ga-1~16.04","8u362-ga-0ubuntu1~16.04.1","8u372-ga~us1-0ubuntu1~16.04","8u382-ga-1~16.04.1","8u392-ga-1~16.04","8u432-ga~us1-0ubuntu2~16.04.4","8u442-b06~us1-0ubuntu1~16.04","8u452-ga~us1-0ubuntu1~16.04.1","8u462-ga~us1-0ubuntu2~16.04.2","8u472-ga-1~16.04","8u482-ga~us1-0ubuntu1~16.04","8u492-ga~us2-0ubuntu1~16.04.1","8u502-ga~us1-0ubuntu1~16.04","8u504-ga-1ubuntu1~16.04.3","8u512-b09~us1-0ubuntu1~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0~rc3-1ubuntu1","6.0~rc3-2ubuntu1","6.0~rc3-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openjdk-9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9~b88-1","9~b101-2ubuntu2","9~b102-1","9~b113-0ubuntu1","9~b114-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.4+12-2ubuntu4","9.0.4+12-4ubuntu1","10~46-4ubuntu1","10~46-5ubuntu1","10.0.1+10-1ubuntu2","10.0.1+10-3ubuntu1","10.0.2+13-1ubuntu0.18.04.1","10.0.2+13-1ubuntu0.18.04.2","10.0.2+13-1ubuntu0.18.04.3","10.0.2+13-1ubuntu0.18.04.4","11.0.2+9-3ubuntu1~18.04.3","11.0.3+7-1ubuntu2~18.04.1","11.0.4+11-1ubuntu2~18.04.3","11.0.5+10-0ubuntu1.1~18.04","11.0.6+10-1ubuntu1~18.04.1","11.0.7+10-2ubuntu2~18.04","11.0.8+10-0ubuntu1~18.04.1","11.0.9+11-0ubuntu1~18.04.1","11.0.9.1+1-0ubuntu1~18.04","11.0.10+9-0ubuntu1~18.04","11.0.11+9-0ubuntu2~18.04","11.0.13+8-0ubuntu1~18.04","11.0.14+9-0ubuntu2~18.04","11.0.14.1+1-0ubuntu1~18.04","11.0.15+10-0ubuntu0.18.04.1","11.0.16+8-0ubuntu1~18.04","11.0.17+8-1ubuntu2~18.04","11.0.18+10-0ubuntu1~18.04.1","11.0.19+7~us1-0ubuntu1~18.04.1","11.0.20+8-1ubuntu1~18.04","11.0.20.1+1-0ubuntu1~18.04","11.0.21+9-0ubuntu1~18.04","11.0.22+7-0ubuntu2~18.04.1","11.0.23+9-1ubuntu1~18.04.1","11.0.25+9-1ubuntu1~18.04","11.0.26+4-1ubuntu1~18.04","11.0.27+6~us1-0ubuntu1~18.04","11.0.28+6-1ubuntu1~18.04.1","11.0.29+7-1ubuntu1~18.04","11.0.30+7-1ubuntu1~18.04","11.0.31+11-1ubuntu1~18.04.2","11.0.32+9-1ubuntu1~18.04","11.0.32.1+1-1ubuntu1~18.04","11.0.33+9-1ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0-1","6.1-1","6.2-1","6.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17+35-1~18.04","17.0.1+12-1~18.04","17.0.2+8-1~18.04","17.0.3+7-0ubuntu0.18.04.1","17.0.4+8-1~18.04","17.0.5+8-2ubuntu1~18.04","17.0.6+10-0ubuntu1~18.04.1","17.0.7+7~us1-0ubuntu1~18.04","17.0.8+7-1~18.04","17.0.8.1+1~us1-0ubuntu1~18.04","17.0.9+9-1~18.04","17.0.10+7-1~18.04.1","17.0.11+9-1~18.04.1","17.0.13+11-2ubuntu1~18.04.2","17.0.14+7-1~18.04","17.0.15+6~us1-0ubuntu1~18.04","17.0.16+8~us1-0ubuntu1~18.04.1","17.0.17+10-1~18.04","17.0.18+8-1~18.04","17.0.19+10-1~18.04.2","17.0.20+8-1~18.04","17.0.20.1+1-1~18.04","17.0.21.0.3+1-1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u144-b01-2","8u151-b12-1","8u162-b12-1","8u171-b11-0ubuntu0.18.04.1","8u181-b13-0ubuntu0.18.04.1","8u181-b13-1ubuntu0.18.04.1","8u191-b12-0ubuntu0.18.04.1","8u191-b12-2ubuntu0.18.04.1","8u212-b03-0ubuntu1.18.04.1","8u222-b10-1ubuntu1~18.04.1","8u232-b09-0ubuntu1~18.04.1","8u242-b08-0ubuntu3~18.04","8u252-b09-1~18.04","8u265-b01-0ubuntu2~18.04","8u272-b10-0ubuntu1~18.04","8u275-b01-0ubuntu1~18.04","8u282-b08-0ubuntu1~18.04","8u292-b10-0ubuntu1~18.04","8u312-b07-0ubuntu1~18.04","8u342-b07-0ubuntu1~18.04","8u352-ga-1~18.04","8u362-ga-0ubuntu1~18.04.1","8u372-ga~us1-0ubuntu1~18.04","8u382-ga-1~18.04.1","8u392-ga-1~18.04","8u402-ga-2ubuntu1~18.04","8u412-ga-1~18.04.1","8u422-b05-1~18.04","8u432-ga~us1-0ubuntu2~18.04","8u442-b06~us1-0ubuntu1~18.04","8u452-ga~us1-0ubuntu1~18.04","8u462-ga~us1-0ubuntu2~18.04.2","8u472-ga-1~18.04","8u482-ga~us1-0ubuntu1~18.04","8u492-ga~us2-0ubuntu1~18.04.1","8u502-ga~us1-0ubuntu1~18.04","8u504-ga-1ubuntu1~18.04.3","8u512-b09~us1-0ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.5+10-0ubuntu1","11.0.5+10-2ubuntu1","11.0.6+10-1ubuntu1","11.0.6+10-2ubuntu2","11.0.7+9-1ubuntu1","11.0.7+10-2ubuntu1","11.0.7+10-3ubuntu1","11.0.8+10-0ubuntu1~20.04","11.0.9+11-0ubuntu1~20.04","11.0.9.1+1-0ubuntu1~20.04","11.0.10+9-0ubuntu1~20.04","11.0.11+9-0ubuntu2~20.04","11.0.13+8-0ubuntu1~20.04","11.0.14+9-0ubuntu2~20.04","11.0.14.1+1-0ubuntu1~20.04","11.0.15+10-0ubuntu0.20.04.1","11.0.16+8-0ubuntu1~20.04","11.0.17+8-1ubuntu2~20.04","11.0.18+10-0ubuntu1~20.04.1","11.0.19+7~us1-0ubuntu1~20.04.1","11.0.20+8-1ubuntu1~20.04","11.0.20.1+1-0ubuntu1~20.04","11.0.21+9-0ubuntu1~20.04","11.0.22+7-0ubuntu2~20.04.1","11.0.23+9-1ubuntu1~20.04.2","11.0.24+8-1ubuntu3~20.04","11.0.25+9-1ubuntu1~20.04","11.0.26+4-1ubuntu1~20.04","11.0.27+6~us1-0ubuntu1~20.04","11.0.28+6-1ubuntu1~20.04.1","11.0.29+7-1ubuntu1~20.04","11.0.30+7-1ubuntu1~20.04","11.0.31+11-1ubuntu1~20.04.2","11.0.32+9-1ubuntu1~20.04","11.0.32.1+1-1ubuntu1~20.04","11.0.33+9-1ubuntu1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3-1","6.4.1-1","6.4.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13+33-1","13.0.1+9-2","13.0.2+8-1","13.0.2+8-2","13.0.3+3-1ubuntu2","13.0.4+8-1~20.04","13.0.7+5-0ubuntu1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.0.1+9-1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17+35-1~20.04","17.0.1+12-1~20.04","17.0.2+8-1~20.04","17.0.3+7-0ubuntu0.20.04.1","17.0.4+8-1~20.04","17.0.5+8-2ubuntu1~20.04","17.0.6+10-0ubuntu1~20.04.1","17.0.7+7~us1-0ubuntu1~20.04","17.0.8+7-1~20.04.2","17.0.8.1+1~us1-0ubuntu1~20.04","17.0.9+9-1~20.04","17.0.10+7-1~20.04.1","17.0.11+9-1~20.04.2","17.0.12+7-1ubuntu2~20.04","17.0.13+11-2ubuntu1~20.04","17.0.14+7-1~20.04","17.0.15+6~us1-0ubuntu1~20.04","17.0.16+8~us1-0ubuntu1~20.04.6","17.0.17+10-1~20.04","17.0.18+8-1~20.04","17.0.19+10-1~20.04.2","17.0.20+8-1~20.04","17.0.20.1+1-1~20.04","17.0.21.0.3+1-1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openjdk-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.0.1+12-2~20.04.1","21.0.2+13-1~20.04.1","21.0.3+9-1ubuntu1~20.04.1","21.0.4+7-1ubuntu2~20.04","21.0.5+11-1ubuntu1~20.04","21.0.6+7-1~20.04.1","21.0.7+6~us1-0ubuntu1~20.04","21.0.8+9~us1-0ubuntu1~20.04.1","21.0.9+10-1~20.04","21.0.10+7-1~20.04","21.0.11+10-1~20.04.2","21.0.12+8-1~20.04","21.0.12.1+1-1~20.04.4","21.0.13.0.3+1-1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u232-b09-0ubuntu1","8u232-b09-1","8u242-b04-1","8u242-b08-0ubuntu3","8u252-b07-1","8u252-b09-1ubuntu1","8u265-b01-0ubuntu2~20.04","8u272-b10-0ubuntu1~20.04","8u275-b01-0ubuntu1~20.04","8u282-b08-0ubuntu1~20.04","8u292-b10-0ubuntu1~20.04","8u312-b07-0ubuntu1~20.04","8u342-b07-0ubuntu1~20.04","8u352-ga-1~20.04","8u362-ga-0ubuntu1~20.04.1","8u372-ga~us1-0ubuntu1~20.04","8u382-ga-1~20.04.1","8u392-ga-1~20.04","8u402-ga-2ubuntu1~20.04","8u412-ga-1~20.04.1","8u422-b05-1~20.04","8u432-ga~us1-0ubuntu2~20.04","8u442-b06~us1-0ubuntu1~20.04","8u452-ga~us1-0ubuntu1~20.04","8u462-ga~us1-0ubuntu2~20.04.2","8u472-ga-1~20.04","8u482-ga~us1-0ubuntu1~20.04","8u492-ga~us2-0ubuntu1~20.04.1","8u502-ga~us1-0ubuntu1~20.04","8u504-ga-1ubuntu1~20.04.3","8u512-b09~us1-0ubuntu1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1","6.5.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17+35-1","17.0.1+12-1","17.0.2+8-1","17.0.3+7-0ubuntu0.22.04.1","17.0.4+8-1~22.04","17.0.5+8-2ubuntu1~22.04","17.0.6+10-0ubuntu1~22.04","17.0.7+7~us1-0ubuntu1~22.04.2","17.0.8+7-1~22.04","17.0.8.1+1~us1-0ubuntu1~22.04","17.0.9+9-1~22.04","17.0.10+7-1~22.04.1","17.0.11+9-1~22.04.1","17.0.12+7-1ubuntu2~22.04","17.0.13+11-2ubuntu1~22.04","17.0.14+7-1~22.04.1","17.0.15+6~us1-0ubuntu1~22.04","17.0.16+8~us1-0ubuntu1~22.04.1","17.0.17+10-1~22.04","17.0.18+8-1~22.04.1","17.0.19+10-1~22.04.2","17.0.20+8-1~22.04","17.0.20.1+1-1~22.04","17.0.21.0.3+1-1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18~15ea-4","18~20ea-1","18~32ea-1","18~36ea-1","18.0.2+9-2~22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.0.1+12-2~22.04","21.0.2+13-1~22.04.1","21.0.3+9-1ubuntu1~22.04.1","21.0.4+7-1ubuntu2~22.04","21.0.5+11-1ubuntu1~22.04","21.0.6+7-1~22.04.1","21.0.7+6~us1-0ubuntu1~22.04","21.0.8+9~us1-0ubuntu1~22.04.1","21.0.9+10-1~22.04","21.0.10+7-1~22.04","21.0.11+10-1~22.04.2","21.0.12+8-1~22.04","21.0.12.1+1-1~22.04.4","21.0.13.0.3+1-1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25+36-1~22.04.2","25.0.1+8-1~22.04","25.0.2+10-1~22.04","25.0.3+9-2~22.04.2","25.0.4+7-1~22.04","25.0.4.1+1-1~22.04.4","25.0.5.0.3+1-1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u302-b08-0ubuntu2","8u312-b07-0ubuntu1","8u342-b07-0ubuntu1~22.04","8u352-ga-1~22.04","8u362-ga-0ubuntu1~22.04","8u372-ga~us1-0ubuntu1~22.04","8u382-ga-1~22.04.1","8u392-ga-1~22.04","8u402-ga-2ubuntu1~22.04","8u412-ga-1~22.04.1","8u422-b05-1~22.04","8u432-ga~us1-0ubuntu2~22.04","8u442-b06~us1-0ubuntu1~22.04","8u452-ga~us1-0ubuntu1~22.04","8u462-ga~us1-0ubuntu2~22.04.2","8u472-ga-1~22.04","8u482-ga~us1-0ubuntu1~22.04","8u492-ga~us2-0ubuntu1~22.04.1","8u502-ga~us1-0ubuntu1~22.04","8u504-ga-1ubuntu1~22.04.3","8u512-b09~us1-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.12+7-0ubuntu3","11.0.13+8-0ubuntu1","11.0.14+9-0ubuntu2","11.0.14.1+1-0ubuntu1","11.0.15+10-0ubuntu0.22.04.1","11.0.16+8-0ubuntu1~22.04","11.0.17+8-1ubuntu2~22.04","11.0.18+10-0ubuntu1~22.04","11.0.19+7~us1-0ubuntu1~22.04.1","11.0.20+8-1ubuntu1~22.04","11.0.20.1+1-0ubuntu1~22.04","11.0.21+9-0ubuntu1~22.04","11.0.22+7-0ubuntu2~22.04.1","11.0.23+9-1ubuntu1~22.04.1","11.0.24+8-1ubuntu3~22.04","11.0.25+9-1ubuntu1~22.04","11.0.26+4-1ubuntu1~22.04","11.0.27+6~us1-0ubuntu1~22.04","11.0.28+6-1ubuntu1~22.04.1","11.0.29+7-1ubuntu1~22.04","11.0.30+7-1ubuntu1~22.04","11.0.31+11-1ubuntu1~22.04.2","11.0.32+9-1ubuntu1~22.04","11.0.32.1+1-1ubuntu1~22.04","11.0.33+9-1ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.0.9~6ea-1","17.0.9+9-1","17.0.9+9-2","17.0.10~6ea-1","17.0.10+7-1","17.0.11~7ea-1","17.0.11~7ea-1build1","17.0.11+9-1","17.0.12+7-1ubuntu2~24.04","17.0.13+11-2ubuntu1~24.04","17.0.14+7-1~24.04","17.0.15+6~us1-0ubuntu1~24.04","17.0.16+8~us1-0ubuntu1~24.04.1","17.0.17+10-1~24.04","17.0.18+8-1~24.04.1","17.0.19+10-1~24.04.2","17.0.20+8-1~24.04","17.0.20.1+1-1~24.04","17.0.21.0.3+1-1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openjdk-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21+35-1","21.0.1+12-2","21.0.1+12-3","21.0.2+13-1","21.0.2+13-2","21.0.3~7ea-1","21.0.3~7ea-1build1","21.0.3~7ea-1build2","21.0.3+9-1","21.0.3+9-1ubuntu1","21.0.4+7-1ubuntu2~24.04","21.0.5+11-1ubuntu1~24.04","21.0.6+7-1~24.04.1","21.0.7+6~us1-0ubuntu1~24.04","21.0.8+9~us1-0ubuntu1~24.04.1","21.0.9+10-1~24.04","21.0.10+7-1~24.04","21.0.11+10-1~24.04.2","21.0.12+8-1~24.04","21.0.12.1+1-1~24.04.4","21.0.13.0.3+1-1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openjdk-25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25+36-1~24.04.2","25.0.1+8-1~24.04","25.0.2+10-1~24.04","25.0.3+9-2~24.04.2","25.0.4+7-1~24.04","25.0.4.1+1-1~24.04.4","25.0.5.0.3+1-1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u382-ga-1ubuntu1","8u392-ga-1","8u402-ga-1","8u402-ga-2","8u402-ga-2ubuntu1","8u402-ga-2ubuntu6","8u402-ga-2ubuntu7","8u402-ga-8build1","8u412-ga-1~24.04.2","8u422-b05-1~24.04","8u432-ga~us1-0ubuntu2~24.04","8u442-b06~us1-0ubuntu1~24.04","8u452-ga~us1-0ubuntu1~24.04","8u462-ga~us1-0ubuntu2~24.04.2","8u472-ga-1~24.04","8u482-ga~us1-0ubuntu1~24.04","8u492-ga~us2-0ubuntu1~24.04.1","8u502-ga~us1-0ubuntu1~24.04","8u504-ga-1ubuntu1~24.04.3","8u512-b09~us1-0ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.20+8-1ubuntu1","11.0.21+9-0ubuntu1","11.0.22+7-0ubuntu2","11.0.23~7ea-1ubuntu1","11.0.23~7ea-1ubuntu2","11.0.23+9-1ubuntu1","11.0.24+8-1ubuntu3~24.04.1","11.0.25+9-1ubuntu1~24.04","11.0.26+4-1ubuntu1~24.04","11.0.27+6~us1-0ubuntu1~24.04","11.0.28+6-1ubuntu1~24.04.1","11.0.29+7-1ubuntu1~24.04","11.0.30+7-1ubuntu1~24.04","11.0.31+11-1ubuntu1~24.04.2","11.0.32+9-1ubuntu1~24.04","11.0.32.1+1-1ubuntu1~24.04","11.0.33+9-1ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.12.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.0.18+8-1","17.0.19+10-1","17.0.20~5ea-1","17.0.20+8-1","17.0.20.1+1-1","17.0.21~6ea-1","17.0.21.0.3+1-1~26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-17-crac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.0.18+8-0ubuntu1","17.0.19+10-0ubuntu1","17.0.20+8-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.0.11~8ea-1","21.0.11+10-1","21.0.12~5ea-1","21.0.12+8-1","21.0.12.1+1-1","21.0.13.0.3+1-1~26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-21-crac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.0.10+7-0ubuntu1","21.0.11+10-0ubuntu1","21.0.12+8-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.0.3~7ea-2","25.0.3+9-2","25.0.4~4ea-1","25.0.4+7-1","25.0.4.1+1-1","25.0.5.0.3+1-1~26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u482-ga~us1-0ubuntu1","8u492-ga~us2-0ubuntu2","8u502-ga~us1-0ubuntu1","8u504-ga-1ubuntu1","8u512-b09~us1-0ubuntu1~26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.30+7-1ubuntu1","11.0.31+11-1ubuntu2","11.0.32+9-1ubuntu1","11.0.32.1+1-1ubuntu1","11.0.32.1+1-1ubuntu2","11.0.33+9-1ubuntu1~26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.0-1","6.10.0-1build1","6.12.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.0.17~8ea-1","17.0.17+10-1","17.0.18~7ea-1","17.0.18+8-1","17.0.19+10-1~26.04.2","17.0.20+8-1~26.04","17.0.20.1+1-1~26.04","17.0.21.0.3+1-1~26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openjdk-17-crac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.0.16+8-0ubuntu1","17.0.17+10-0ubuntu1","17.0.18+8-0ubuntu1","17.0.19+10-0ubuntu1~26.04.1","17.0.20+8-0ubuntu1~26.04"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openjdk-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.0.9~8ea-1","21.0.9+10-1","21.0.10~4ea-1","21.0.10~6ea-1","21.0.10+7-1","21.0.11~5ea-1","21.0.11~8ea-1","21.0.11+10-1~26.04.2","21.0.12+8-1~26.04","21.0.12.1+1-1~26.04.4","21.0.13.0.3+1-1~26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openjdk-21-crac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.0.8+9-0ubuntu1","21.0.9+10-0ubuntu1","21.0.10+7-0ubuntu1","21.0.11+10-0ubuntu1~26.04.1","21.0.12+8-0ubuntu1~26.04"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openjdk-25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25+36-1","25.0.1+8-1","25.0.1+8-2","25.0.1+8-3","25.0.2+10-1","25.0.3~5ea-2","25.0.3~7ea-2","25.0.3+9-2~26.04.2","25.0.4+7-1~26.04","25.0.4.1+1-1~26.04.4","25.0.5.0.3+1-1~26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u462-ga-1","8u472-ga~us1-0ubuntu1","8u472-ga-1","8u482-ga~us1-0ubuntu1","8u492-ga~us2-0ubuntu1~26.04.1","8u502-ga~us1-0ubuntu1~26.04","8u504-ga-1ubuntu1~26.04.3","8u512-b09~us1-0ubuntu1~26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.28+6-1ubuntu1","11.0.29+7-1ubuntu1","11.0.30+7-1ubuntu1","11.0.31+11-1ubuntu1~26.04.2","11.0.32+9-1ubuntu1~26.04","11.0.32.1+1-1ubuntu1~26.04","11.0.33+9-1ubuntu1~26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"bcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.0-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"apache software foundation","product":"apache commons bcel"}],"references":[{"url":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch","tags":["patch","fix"]},{"url":"https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6","tags":["vendor-advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/12","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94114","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/d87nxx7nb5bombqggxhxo9lz16nwtsf9"},{"url":"https://github.com/advisories/GHSA-2p8h-ph4h-rm2f"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94114.json","tags":["advisory"]},{"url":"https://gitbox.apache.org/repos/asf/commons-bcel.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-94114","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624258-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1284399","tags":["report"]},{"url":"https://bugzilla.suse.com/1284400","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94114","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-94114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94114","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/07/12","tags":["report"]},{"url":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b","tags":["report"]},{"url":"https://lists.apache.org/thread/d87nxx7nb5bombqggxhxo9lz16nwtsf9","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-94114","title":"Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning","description":"Symbolic name not mapping to correct class.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.","status":"published","published":"2026-10-06T19:42:30.421Z","modified":"2026-10-08T05:26:10.375Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-386"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-93970","description":"Symbolic name not mapping to correct class.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.","status":"published","published":"2026-10-06T19:42:30Z","modified":"2026-10-08T05:26:10Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:33.098422Z"}],"ghsa":[{"id":"GHSA-2p8h-ph4h-rm2f","title":"Symbolic name not mapping to correct object vulnerability in Apache Commons.\n\n\n\nBCEL caches...","description":"Symbolic name not mapping to correct object vulnerability in Apache Commons.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.","status":"published","published":"2026-10-06T21:32:03Z","modified":"2026-10-08T06:31:14Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-386"],"updated_at":"2026-11-02T15:12:55.932488Z"}],"nvd":[{"id":"CVE-2026-94114","description":"Symbolic name not mapping to correct class.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.","status":"published","published":"2026-10-06T20:17:34.42Z","modified":"2026-10-08T06:16:45.597Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-386"],"updated_at":"2026-11-02T14:12:54.809359Z"}],"osv":[{"id":"CVE-2026-94114","title":"Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning","description":"Symbolic name not mapping to correct class.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.","status":"published","published":"2026-10-06T19:42:30.421Z","modified":"2026-10-28T11:00:56.809040121Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-386"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"DEBIAN-CVE-2026-94114","description":"Symbolic name not mapping to correct class.    BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.    This issue affects Apache Commons BCEL: before 6.13.0.    Users are recommended to upgrade to version 6.13.0, which fixes the issue.","status":"published","published":"2026-10-06T20:17:34.42Z","modified":"2026-10-31T04:00:07.042352694Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-94114","description":"Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.","status":"published","published":"2026-10-06T20:17:00Z","modified":"2026-11-10T02:52:19.575620452Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-10T03:21:05.442766Z"},{"id":"AZL-108017","title":"CVE-2026-94114 affecting package bcel 5.2-37","description":"Symbolic name not mapping to correct class.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.","status":"published","published":"2026-10-06T20:17:34Z","modified":"2026-10-19T05:33:46Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"openSUSE-SU-2026:12080-1","title":"bcel-6.13.0-1.1 on GA media","description":"These are all security issues fixed in the bcel-6.13.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-09T17:23:13.518166677Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22109-1","title":"Security update for bcel","description":"This update for bcel fixes the following issues:\n\n- CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400).\n- CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399).\n\nChanges for bcel:\n\n- Update to version 6.13.0\n * New Features\n + Add support for permitted subclasses\n + Add RecordComponentInfo.getAttribute(byte tag)\n + Add Const.MAJOR_27\n + Add Const.MINOR_27\n + Add and use ArrayType.isElementType(Type)\n + Add Const.MAJOR_28\n + Add Const.MINOR_28\n * Fixed Bugs\n + Fix constant pool module access test on Java 26 and above\n + Deprecate org.apache.bcel.classfile.Utility.Utility()\n + Deprecate org.apache.bcel.verifier.exc.Utility\n .getStackTrace(Throwable)\n + Fix all Javadoc warnings and enforce checks by default\n + Escape constant pool names in generated HTML\n + Escape referenced names in BCELFactory Java output\n + Make wide flag thread-local in Utility.codeToString\n + Read multianewarray dimensions as unsigned byte\n + Site docs: clarify security model\n + Read ConstantDynamic indices as unsigned shorts\n + Validate index upper bound in CPInstruction, IINC and RET\n setIndex\n + Use correct attribute tag in NestHost and ModuleMainClass\n + Propagate runtime-visible flag when parsing parameter\n annotations\n + Use fixedLength for parsed LOOKUPSWITCH length\n + Fix ConstantPoolGen dedup key collisions for names with\n delimiters\n + Read unsigned bytecode operands in CodeHTML disassembler\n + Deep-copy bootstrap arguments array in BootstrapMethod.copy()\n + Use exclusive live-range end in LocalVariableTable\n .getLocalVariable\n + Build TABLESWITCH from sorted arrays in SWITCH\n + Use array element type not basic type for primitive array\n access\n + Set length in INVOKEDYNAMIC constructor\n + Reject CALOAD on non-char arrays in structural verification\n + Add negative verifier tests for remaining array load/store\n component type checks\n + Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY\n + Match wide local variable instruction length to dumped bytes\n + Bound IINC increment to signed short\n + Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8\n + Nested Code/Record attributes drive unbounded parse-time\n recursion in ClassParser\n + Nested annotation element values recurse unboundedly;\n MAX_ARRAY_DIMENSIONS cap bypassed\n + Opcodes tableswitch and lookupswitch add boundary checks\n + JustIce Pass 2 hangs on cyclic superclass chain of a\n referenced exception class\n + JustIce Pass 2 LVT check amplifies each 10-byte entry into\n ~131k hashtable operations\n + Pass 3b dataflow stores frames per instruction and clones\n ever-growing execution chains\n + Cubic handlers * range * subroutines scan in Subroutines\n constructor hangs JustIce Pass 3b\n + Subroutines.noRecursiveCalls enumerates exponentially many JSR\n call paths\n + Disassembler and Class2HTML re-implement the unchecked\n switch-table allocation\n + ConstantPool.constantToString recurses forever on\n self-referencing CONSTANT_MethodHandle\n + Utility.typeSignatureToString recurses per generic-nesting\n level, unbounded, with quadratic substring copies\n + Repositories cache classes under the input-defined this_class\n name; global static Repository/VerifierFactory make the\n poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114)\n + Silent u2/u1 count truncation across dump paths corrupts\n emitted bytecode\n + Class2HTML emitters write attacker class-file strings into\n HTML unescaped (stored XSS in reports) (bsc#1284399,\n CVE-2026-105111)\n + Class2HTML builds output file paths from the unvalidated class\n name\n + ClassPath.getBytes() sizes its buffer from the forged ZIP\n uncompressed-size field\n + PMG attribute ignores declared length, enabling BCEL-vs-JVM\n parse divergence\n + Signature.matchGJIdent recurses unboundedly on nested generic\n signatures (Signature.translate)\n + Utility.decode fixed 3x buffer breaks the encode/decode round\n trip and throws unchecked AIOOBE\n + BCELifier interpolates attacker class/package names into\n generated Java source unescaped\n + Verifier pass 3a delayed checks are quadratic in attribute and\n code size\n + Verifier cache grows unboundedly with attacker-chosen class\n names\n + Static WIDE ThreadLocal survives exceptions, corrupting the\n next class's disassembly on the same thread\n + Utility.JavaReader escape decoding: OOB table index, bad-hex\n crash, silent non-canonical aliasing\n * Changes\n + Bump org.apache.commons:commons-parent from 95 to 104\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20\n + Bump commons-io:commons-io from 2.21.0 to 2.22.0\n + Bump jna.version from 5.18.1 to 5.19.1\n + [test] Bump org.apache.commons:commons-collections4 from 4.5.0\n to 4.6.0\n- Changes of version 6.12.0\n + Add Const.MAJOR_26\n + Add Const.MINOR_26\n + Fix infinite loop in example.TransitiveHull\n + Fix Apache RAT plugin console warnings\n + Fix malformed Javadoc comments\n + Make the build reproducible on the Azul JDK\n + Fix infinite loop in JavaClass.findField() on invalid input\n + Fix infinite loop in JavaClass.getAllInterfaces() on invalid\n input\n + Fix infinite loop in JavaClass.getSuperClasses() on invalid\n + Exception message in Args.requireU4() refers to the wrong data\n type\n + Exception message in Args.requireU2() refers to the wrong\n upper range value\n + Code.Code(int, int, DataInput, ConstantPool) now throws a\n ClassFormatException if the code array is greater than the\n JVM specification allows\n + Code.Code(int, int, int, int, byte[], CodeException[],\n Attribute[], ConstantPool) now throws a ClassFormatException\n if the code array is greater than the JVM specification allows\n + Code.setCode(byte[]) now throws a ClassFormatException if the\n code array is greater than the JVM specification allows\n + ClassDumper.dump() should not call the input stream it didn't\n open; fixes IOException when calling DumpClass.main\n (ClassDumper.java:351)\n + org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[])\n now uses varagrs: ConstantPool(Constant...)\n + org.apache.bcel.classfile.Deprecated now requires its the\n attribute_length item be zero\n + org.apache.bcel.classfile.Synthetic now requires its the\n + The size of an Attribute unknown to the JVM specification is\n limited to 1 MB and is overridden with the system property\n BCEL.Attribute.Unknown.max_attribute_length\n + Bump org.apache.commons:commons-parent from 89 to 95\n + [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to\n 2.3.0\n + Bump commons-io:commons-io from 2.20.0 to 2.21.0\n + Bump commons-lang3 from 3.19.0 to 3.20.0\n + [test] Bump org.apache.commons:commons-exec from 1.5.0 to\n 1.6.0\n- Changes of version 6.11.0\n + Add Const.MAJOR_25\n + Add Const.MINOR_25\n + Add experimental CycloneDX VEX file\n + Refactor to use new Maven POM variable ecj.version\n + Replace internal use of Locale.ENGLISH with Locale.ROOT\n + BCEL-375: Wrong permissions on bcel .jar file in binary\n .tar.gz distribution file\n + BCEL-376: ClassPath.close() throws\n UnsupportedOperationException when created with\n system-classpath\n + ClassPath.getResources(String) can use an ArrayList instead of\n a Vector\n + Fix SpotBugs [ERROR] Medium: Operation on the \"created\" shared\n variable in \"ConstantUtf8\" class is not atomic [org.apache\n .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119]\n AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE\n + Fix SpotBugs [ERROR] Medium: Operation on the \"considered\"\n shared variable in \"ConstantUtf8\" class is not atomic [org\n .apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:\n [line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE\n + Fix SpotBugs [ERROR] Medium: Operation on the \"skipped\" shared\n .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134]\n + org.apache.bcel.util.ClassPath\n .addJdkModules(String, List\u003cString\u003e) now reads the system\n property \"jdk.module.path\" instead of \"java.modules.path\"\n + Fix ConstantPoolModuleAccessTest failures on Java 25\n + 377: Fix testing on Java 24 and up\n + Bump org.apache.commons:commons-parent from 72 to 89\n + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20\n + Bump commons-io:commons-io from 2.16.1 to 2.20.0\n + Bump jna.version from 5.14.0 to 5.18.1\n + Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to\n 3.2.1\n + Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to\n 4.5.0\n + Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0\n a minimum of Java 8\n + Fix PMD UnnecessaryFullyQualifiedName\n + Fix PMD EmptyCatchBlock by allowing commented blocks\n + Fix PMD EmptyControlStatement by allowing commented blocks\n JasminVisitor\n + SpotBugs checks should ignore code generated by JavaCC\n + Fix SpotBugs URF_UNREAD_FIELD in ClassDumper\n + Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor\n ASTFunAppl\n Mini.Environment\n + Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC\n + Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[])\n TransitiveHull.getIgnored()\n + Add accessors to model and unit tests, Javadoc\n + Add Const.MAJOR_22\n + Add Const.MINOR_22\n + Add Const.MAJOR_23\n + Add Const.MINOR_23\n + Add Const.MAJOR_24\n + Add Const.MINOR_24\n 2.0.0\n to 4.5.0-M2\n + Bump org.apache.commons:commons-parent from 69 to 71\n 3.1.0\n * Includes changes from 6.9.0 Maintenance and bug fix release\n + Add Support for Java 16 records\n + Add null guard for InstructionFactory.createInvoke()\n + Avoid possible NullPointerException in\n org.apache.bcel.classfile.DescendingVisitor.accept(E[])\n AnnotationEntryGen[])\n ConstantPoolGen, boolean)\n ElementValue[], ConstantPoolGen)\n org.apache.bcel.generic.ClassGen.setMethods(Method[])\n + Avoid possible NullPointerException in org.apache.bcel.generic\n .ClassGen.unpackAnnotations(Attribute[])\n + Avoid possible NullPointerException in org.apache.bcel\n .classfile.ParameterAnnotationEntry\n .createParameterAnnotationEntries(Attribute[])\n org.apache.bcel.generic.ClassGen.ClassGen(JavaClass)\n .FieldGenOrMethodGen.addAll(Attribute[])\n + Avoid NullPointerException after calling org.apache.bcel\n .classfile.MethodParameters.setParameters(MethodParameter[])\n with null\n .classfile.ParameterAnnotations\n .setParameterAnnotationTable(ParameterAnnotationEntry[])\n .classfile.LocalVariableTypeTable\n .setLocalVariableTable(LocalVariable[]) with null\n .classfile.LocalVariableTable\n .classfile.LineNumberTable.setLineNumberTable(LineNumber[])\n .classfile.JavaClass.setMethods(Method[] with null\n .classfile.JavaClass.setInterfaces(int[]) with null\n .classfile.JavaClass.setInterfaceNames(String[]) with null\n .classfile.JavaClass.setFields(Field[]) with null\n .classfile.JavaClass.setAttributes(Attribute[]) with null\n .classfile.ConstantPool.setConstantPool(Constant[]) with null\n .classfile.FieldOrMethod.setAttributes(Attribute[]) with null\n .classfile.Annotations.setAnnotationTable(AnnotationEntry[])\n .classfile.ArrayElementValue.ArrayElementValue(int,\n ElementValue[], ConstantPool) with null\n .classfile.BootstrapMethod.BootstrapMethod(int, int[]) with\n null\n .classfile.BootstrapMethod.setBootstrapArguments(int[]) with\n .classfile.BootstrapMethods.BootstrapMethods(int, int,\n BootstrapMethod[], ConstantPool) with null\n .classfile.BootstrapMethods\n .setBootstrapMethods(BootstrapMethod[]) with null\n + Avoid NullPointerException calling org.apache.bcel.generic\n .InstructionList.redirectLocalVariables(LocalVariableGen[],\n InstructionHandle, InstructionHandle) with null\n .InstructionList.redirectExceptionHandlers(CodeExceptionGen[],\n .InstructionList.findHandle(InstructionHandle[], int[], int,\n int) with null\n .MethodGen.setArgumentTypes(Type[]) with null\n .MethodGen.setArgumentNames(String[]) with null\n .MethodGen.removeRuntimeAttributes(Attribute[]) with null\n .MethodGen.makeMutableVersion(AnnotationEntry[]) with null\n + Bump org.apache.commons:commons-parent from 66 to 69\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23\n + Bump commons-io:commons-io from 2.15.1 to 2.16.1\n * 6.8.0 (2023-12-08) Maintenance and bug fix release\n ClassFormatException\n input Java4Example\n ~ Add verifier tests on some opcodes\n signatures\n ~ Add Const.MAJOR_20\n ~ Add Const.MINOR_20\n ~ Add Const.MAJOR_21\n ~ Add Const.MINOR_21\n ~ [Bcelifier] stackmap support to pass JDK verifier\n SE_BAD_FIELD\n BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH\n NullPointerException\n not a NullPointerException\n ~ Test and coverage of InstructionFactory\n ~ Verifier: test and coverage for SWAP instruction\n () in it`()'\n ~ Fix null pointers in AnnotationEntry\n supports package-private)\n test\n ATHROW on empty stack\n Select#toString(boolean)\n ~ Fix EmptyVisitorTestCase on Java 21\n ~ Bump commons-parent from 54 to 65\n ~ Bump jna.version from 5.12.1 to 5.13.0\n ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21\n ~ Bump commons-io from 2.11.0 to 2.15.1\n ~ Bump commons-lang3 from 3.12.0 to 3.14.0\n 3.1.1\n * 6.7.0 (2022-11-28) Maintenance and bug fix release\n * 6.6.1 (2022-10-29) Maintenance and bug fix release\n * 6.6.0 (2022-10-08) Minor feature and bug fix release\n * 6.5.0 (2020-06-05) Minor feature and bug fix release\n * 6.4.1 (2019-09-26) Bug fix release\n * 6.4.0 (2019-09-20) Feature and bug fix release\n requires Java 7 or higher to run\n class\n org.apache.bcel.generic.InstructionConsts class\n java.lang.String\n","status":"published","published":"2026-10-16T12:21:25Z","modified":"2026-10-19T17:23:15.937624643Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24258-1","title":"Security update for bcel","description":"This update for bcel fixes the following issues:\n\n- CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400).\n- CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399).\n\nChanges for bcel:\n\n- Update to version 6.13.0\n * New Features\n + Add support for permitted subclasses\n + Add RecordComponentInfo.getAttribute(byte tag)\n + Add Const.MAJOR_27\n + Add Const.MINOR_27\n + Add and use ArrayType.isElementType(Type)\n + Add Const.MAJOR_28\n + Add Const.MINOR_28\n * Fixed Bugs\n + Fix constant pool module access test on Java 26 and above\n + Deprecate org.apache.bcel.classfile.Utility.Utility()\n + Deprecate org.apache.bcel.verifier.exc.Utility\n .getStackTrace(Throwable)\n + Fix all Javadoc warnings and enforce checks by default\n + Escape constant pool names in generated HTML\n + Escape referenced names in BCELFactory Java output\n + Make wide flag thread-local in Utility.codeToString\n + Read multianewarray dimensions as unsigned byte\n + Site docs: clarify security model\n + Read ConstantDynamic indices as unsigned shorts\n + Validate index upper bound in CPInstruction, IINC and RET\n setIndex\n + Use correct attribute tag in NestHost and ModuleMainClass\n + Propagate runtime-visible flag when parsing parameter\n annotations\n + Use fixedLength for parsed LOOKUPSWITCH length\n + Fix ConstantPoolGen dedup key collisions for names with\n delimiters\n + Read unsigned bytecode operands in CodeHTML disassembler\n + Deep-copy bootstrap arguments array in BootstrapMethod.copy()\n + Use exclusive live-range end in LocalVariableTable\n .getLocalVariable\n + Build TABLESWITCH from sorted arrays in SWITCH\n + Use array element type not basic type for primitive array\n access\n + Set length in INVOKEDYNAMIC constructor\n + Reject CALOAD on non-char arrays in structural verification\n + Add negative verifier tests for remaining array load/store\n component type checks\n + Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY\n + Match wide local variable instruction length to dumped bytes\n + Bound IINC increment to signed short\n + Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8\n + Nested Code/Record attributes drive unbounded parse-time\n recursion in ClassParser\n + Nested annotation element values recurse unboundedly;\n MAX_ARRAY_DIMENSIONS cap bypassed\n + Opcodes tableswitch and lookupswitch add boundary checks\n + JustIce Pass 2 hangs on cyclic superclass chain of a\n referenced exception class\n + JustIce Pass 2 LVT check amplifies each 10-byte entry into\n ~131k hashtable operations\n + Pass 3b dataflow stores frames per instruction and clones\n ever-growing execution chains\n + Cubic handlers * range * subroutines scan in Subroutines\n constructor hangs JustIce Pass 3b\n + Subroutines.noRecursiveCalls enumerates exponentially many JSR\n call paths\n + Disassembler and Class2HTML re-implement the unchecked\n switch-table allocation\n + ConstantPool.constantToString recurses forever on\n self-referencing CONSTANT_MethodHandle\n + Utility.typeSignatureToString recurses per generic-nesting\n level, unbounded, with quadratic substring copies\n + Repositories cache classes under the input-defined this_class\n name; global static Repository/VerifierFactory make the\n poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114)\n + Silent u2/u1 count truncation across dump paths corrupts\n emitted bytecode\n + Class2HTML emitters write attacker class-file strings into\n HTML unescaped (stored XSS in reports) (bsc#1284399,\n CVE-2026-105111)\n + Class2HTML builds output file paths from the unvalidated class\n name\n + ClassPath.getBytes() sizes its buffer from the forged ZIP\n uncompressed-size field\n + PMG attribute ignores declared length, enabling BCEL-vs-JVM\n parse divergence\n + Signature.matchGJIdent recurses unboundedly on nested generic\n signatures (Signature.translate)\n + Utility.decode fixed 3x buffer breaks the encode/decode round\n trip and throws unchecked AIOOBE\n + BCELifier interpolates attacker class/package names into\n generated Java source unescaped\n + Verifier pass 3a delayed checks are quadratic in attribute and\n code size\n + Verifier cache grows unboundedly with attacker-chosen class\n names\n + Static WIDE ThreadLocal survives exceptions, corrupting the\n next class's disassembly on the same thread\n + Utility.JavaReader escape decoding: OOB table index, bad-hex\n crash, silent non-canonical aliasing\n * Changes\n + Bump org.apache.commons:commons-parent from 95 to 104\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20\n + Bump commons-io:commons-io from 2.21.0 to 2.22.0\n + Bump jna.version from 5.18.1 to 5.19.1\n + [test] Bump org.apache.commons:commons-collections4 from 4.5.0\n to 4.6.0\n- Changes of version 6.12.0\n + Add Const.MAJOR_26\n + Add Const.MINOR_26\n + Fix infinite loop in example.TransitiveHull\n + Fix Apache RAT plugin console warnings\n + Fix malformed Javadoc comments\n + Make the build reproducible on the Azul JDK\n + Fix infinite loop in JavaClass.findField() on invalid input\n + Fix infinite loop in JavaClass.getAllInterfaces() on invalid\n input\n + Fix infinite loop in JavaClass.getSuperClasses() on invalid\n + Exception message in Args.requireU4() refers to the wrong data\n type\n + Exception message in Args.requireU2() refers to the wrong\n upper range value\n + Code.Code(int, int, DataInput, ConstantPool) now throws a\n ClassFormatException if the code array is greater than the\n JVM specification allows\n + Code.Code(int, int, int, int, byte[], CodeException[],\n Attribute[], ConstantPool) now throws a ClassFormatException\n if the code array is greater than the JVM specification allows\n + Code.setCode(byte[]) now throws a ClassFormatException if the\n code array is greater than the JVM specification allows\n + ClassDumper.dump() should not call the input stream it didn't\n open; fixes IOException when calling DumpClass.main\n (ClassDumper.java:351)\n + org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[])\n now uses varagrs: ConstantPool(Constant...)\n + org.apache.bcel.classfile.Deprecated now requires its the\n attribute_length item be zero\n + org.apache.bcel.classfile.Synthetic now requires its the\n + The size of an Attribute unknown to the JVM specification is\n limited to 1 MB and is overridden with the system property\n BCEL.Attribute.Unknown.max_attribute_length\n + Bump org.apache.commons:commons-parent from 89 to 95\n + [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to\n 2.3.0\n + Bump commons-io:commons-io from 2.20.0 to 2.21.0\n + Bump commons-lang3 from 3.19.0 to 3.20.0\n + [test] Bump org.apache.commons:commons-exec from 1.5.0 to\n 1.6.0\n- Changes of version 6.11.0\n + Add Const.MAJOR_25\n + Add Const.MINOR_25\n + Add experimental CycloneDX VEX file\n + Refactor to use new Maven POM variable ecj.version\n + Replace internal use of Locale.ENGLISH with Locale.ROOT\n + BCEL-375: Wrong permissions on bcel .jar file in binary\n .tar.gz distribution file\n + BCEL-376: ClassPath.close() throws\n UnsupportedOperationException when created with\n system-classpath\n + ClassPath.getResources(String) can use an ArrayList instead of\n a Vector\n + Fix SpotBugs [ERROR] Medium: Operation on the \"created\" shared\n variable in \"ConstantUtf8\" class is not atomic [org.apache\n .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119]\n AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE\n + Fix SpotBugs [ERROR] Medium: Operation on the \"considered\"\n shared variable in \"ConstantUtf8\" class is not atomic [org\n .apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:\n [line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE\n + Fix SpotBugs [ERROR] Medium: Operation on the \"skipped\" shared\n .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134]\n + org.apache.bcel.util.ClassPath\n .addJdkModules(String, List\u003cString\u003e) now reads the system\n property \"jdk.module.path\" instead of \"java.modules.path\"\n + Fix ConstantPoolModuleAccessTest failures on Java 25\n + 377: Fix testing on Java 24 and up\n + Bump org.apache.commons:commons-parent from 72 to 89\n + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20\n + Bump commons-io:commons-io from 2.16.1 to 2.20.0\n + Bump jna.version from 5.14.0 to 5.18.1\n + Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to\n 3.2.1\n + Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to\n 4.5.0\n + Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0\n a minimum of Java 8\n + Fix PMD UnnecessaryFullyQualifiedName\n + Fix PMD EmptyCatchBlock by allowing commented blocks\n + Fix PMD EmptyControlStatement by allowing commented blocks\n JasminVisitor\n + SpotBugs checks should ignore code generated by JavaCC\n + Fix SpotBugs URF_UNREAD_FIELD in ClassDumper\n + Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor\n ASTFunAppl\n Mini.Environment\n + Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC\n + Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[])\n TransitiveHull.getIgnored()\n + Add accessors to model and unit tests, Javadoc\n + Add Const.MAJOR_22\n + Add Const.MINOR_22\n + Add Const.MAJOR_23\n + Add Const.MINOR_23\n + Add Const.MAJOR_24\n + Add Const.MINOR_24\n 2.0.0\n to 4.5.0-M2\n + Bump org.apache.commons:commons-parent from 69 to 71\n 3.1.0\n * Includes changes from 6.9.0 Maintenance and bug fix release\n + Add Support for Java 16 records\n + Add null guard for InstructionFactory.createInvoke()\n + Avoid possible NullPointerException in\n org.apache.bcel.classfile.DescendingVisitor.accept(E[])\n AnnotationEntryGen[])\n ConstantPoolGen, boolean)\n ElementValue[], ConstantPoolGen)\n org.apache.bcel.generic.ClassGen.setMethods(Method[])\n + Avoid possible NullPointerException in org.apache.bcel.generic\n .ClassGen.unpackAnnotations(Attribute[])\n + Avoid possible NullPointerException in org.apache.bcel\n .classfile.ParameterAnnotationEntry\n .createParameterAnnotationEntries(Attribute[])\n org.apache.bcel.generic.ClassGen.ClassGen(JavaClass)\n .FieldGenOrMethodGen.addAll(Attribute[])\n + Avoid NullPointerException after calling org.apache.bcel\n .classfile.MethodParameters.setParameters(MethodParameter[])\n with null\n .classfile.ParameterAnnotations\n .setParameterAnnotationTable(ParameterAnnotationEntry[])\n .classfile.LocalVariableTypeTable\n .setLocalVariableTable(LocalVariable[]) with null\n .classfile.LocalVariableTable\n .classfile.LineNumberTable.setLineNumberTable(LineNumber[])\n .classfile.JavaClass.setMethods(Method[] with null\n .classfile.JavaClass.setInterfaces(int[]) with null\n .classfile.JavaClass.setInterfaceNames(String[]) with null\n .classfile.JavaClass.setFields(Field[]) with null\n .classfile.JavaClass.setAttributes(Attribute[]) with null\n .classfile.ConstantPool.setConstantPool(Constant[]) with null\n .classfile.FieldOrMethod.setAttributes(Attribute[]) with null\n .classfile.Annotations.setAnnotationTable(AnnotationEntry[])\n .classfile.ArrayElementValue.ArrayElementValue(int,\n ElementValue[], ConstantPool) with null\n .classfile.BootstrapMethod.BootstrapMethod(int, int[]) with\n null\n .classfile.BootstrapMethod.setBootstrapArguments(int[]) with\n .classfile.BootstrapMethods.BootstrapMethods(int, int,\n BootstrapMethod[], ConstantPool) with null\n .classfile.BootstrapMethods\n .setBootstrapMethods(BootstrapMethod[]) with null\n + Avoid NullPointerException calling org.apache.bcel.generic\n .InstructionList.redirectLocalVariables(LocalVariableGen[],\n InstructionHandle, InstructionHandle) with null\n .InstructionList.redirectExceptionHandlers(CodeExceptionGen[],\n .InstructionList.findHandle(InstructionHandle[], int[], int,\n int) with null\n .MethodGen.setArgumentTypes(Type[]) with null\n .MethodGen.setArgumentNames(String[]) with null\n .MethodGen.removeRuntimeAttributes(Attribute[]) with null\n .MethodGen.makeMutableVersion(AnnotationEntry[]) with null\n + Bump org.apache.commons:commons-parent from 66 to 69\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23\n + Bump commons-io:commons-io from 2.15.1 to 2.16.1\n * 6.8.0 (2023-12-08) Maintenance and bug fix release\n ClassFormatException\n input Java4Example\n ~ Add verifier tests on some opcodes\n signatures\n ~ Add Const.MAJOR_20\n ~ Add Const.MINOR_20\n ~ Add Const.MAJOR_21\n ~ Add Const.MINOR_21\n ~ [Bcelifier] stackmap support to pass JDK verifier\n SE_BAD_FIELD\n BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH\n NullPointerException\n not a NullPointerException\n ~ Test and coverage of InstructionFactory\n ~ Verifier: test and coverage for SWAP instruction\n () in it`()'\n ~ Fix null pointers in AnnotationEntry\n supports package-private)\n test\n ATHROW on empty stack\n Select#toString(boolean)\n ~ Fix EmptyVisitorTestCase on Java 21\n ~ Bump commons-parent from 54 to 65\n ~ Bump jna.version from 5.12.1 to 5.13.0\n ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21\n ~ Bump commons-io from 2.11.0 to 2.15.1\n ~ Bump commons-lang3 from 3.12.0 to 3.14.0\n 3.1.1\n * 6.7.0 (2022-11-28) Maintenance and bug fix release\n * 6.6.1 (2022-10-29) Maintenance and bug fix release\n * 6.6.0 (2022-10-08) Minor feature and bug fix release\n * 6.5.0 (2020-06-05) Minor feature and bug fix release\n * 6.4.1 (2019-09-26) Bug fix release\n * 6.4.0 (2019-09-20) Feature and bug fix release\n requires Java 7 or higher to run\n class\n org.apache.bcel.generic.InstructionConsts class\n java.lang.String\n","status":"published","published":"2026-10-16T12:21:24Z","modified":"2026-10-23T17:23:10.61837878Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}