{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94114", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-20T11:44:30.281Z", "datePublished": "2026-10-06T19:42:30.421Z", "dateUpdated": "2026-10-07T06:12:16.240Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-06T19:42:30.421Z"}, "title": "Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser", "problemTypes": [{"descriptions": [{"description": "CWE-386 Symbolic name not mapping to correct object", "lang": "en", "cweId": "CWE-386", "type": "CWE"}]}], "source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Commons BCEL", "packageURL": "pkg:maven/org.apache.bcel/bcel", "repo": "https://gitbox.apache.org/repos/asf/commons-bcel.git", "versions": [{"status": "affected", "version": "0", "lessThan": "6.13.0", "versionType": "maven"}, {"status": "affected", "version": "0", "lessThan": "14890bf2b9014df25f9b4de86f29b5e917e5656b", "versionType": "git"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.bcel:bcel"}], "descriptions": [{"value": "Symbolic name not mapping to correct object vulnerability in Apache Commons.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Symbolic name not mapping to correct object vulnerability in Apache Commons.</p><p>BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.</p><p>This issue affects Apache Commons: before 6.13.0.</p><p>Users are recommended to upgrade to version 6.13.0, which fixes the issue.</p>"}]}], "references": [{"url": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread.html/d87nxx7nb5bombqggxhxo9lz16nwtsf9", "tags": ["vendor-advisory"]}], "metrics": [{"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}}, {"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}}, {"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Claude Security", "type": "tool"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T19:59:20.212043Z", "id": "CVE-2026-94114", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T19:59:30.889Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/07/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-07T06:12:16.240Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/07/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-07T06:12:16.240Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94114", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T19:59:20.212043Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T19:59:25.963Z"}}], "cna": {"title": "Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "The Apache Software Foundation"}, {"lang": "en", "type": "tool", "value": "Claude Security"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://gitbox.apache.org/repos/asf/commons-bcel.git", "vendor": "Apache Software Foundation", "product": "Apache Commons BCEL", "versions": [{"status": "affected", "version": "0", "lessThan": "6.13.0", "versionType": "maven"}, {"status": "affected", "version": "0", "lessThan": "14890bf2b9014df25f9b4de86f29b5e917e5656b", "versionType": "git"}], "packageURL": "pkg:maven/org.apache.bcel/bcel", "packageName": "org.apache.bcel:bcel", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread.html/d87nxx7nb5bombqggxhxo9lz16nwtsf9", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Symbolic name not mapping to correct object vulnerability in Apache Commons.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Symbolic name not mapping to correct object vulnerability in Apache Commons.</p><p>BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.</p><p>This issue affects Apache Commons: before 6.13.0.</p><p>Users are recommended to upgrade to version 6.13.0, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-386", "description": "CWE-386 Symbolic name not mapping to correct object"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-06T19:42:30.421Z"}}}, "cveMetadata": {"cveId": "CVE-2026-94114", "state": "PUBLISHED", "dateUpdated": "2026-10-07T06:12:16.240Z", "dateReserved": "2026-09-20T11:44:30.281Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-10-06T19:42:30.421Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.bcel:bcel", "packageURL": "pkg:maven/org.apache.bcel/bcel", "product": "Apache Commons BCEL", "repo": "https://gitbox.apache.org/repos/asf/commons-bcel.git", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "6.13.0", "status": "affected", "version": "0", "versionType": "maven"}, {"lessThan": "14890bf2b9014df25f9b4de86f29b5e917e5656b", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Symbolic name not mapping to correct object vulnerability in Apache Commons.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue."}], "id": "CVE-2026-94114", "lastModified": "2026-10-07T13:35:14.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security@apache.org", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94114", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T19:59:20.212043Z", "version": "2.0.3"}}]}, "published": "2026-10-06T20:17:34.420", "references": [{"source": "security@apache.org", "url": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/d87nxx7nb5bombqggxhxo9lz16nwtsf9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/07/12"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-386"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.bcel/bcel: Apache Commons BCEL: Security verification bypass via unvalidated class caching", "id": "2547121", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547121"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-386", "details": ["A flaw was found in Apache Commons BCEL (Byte Code Engineering Library). When loading untrusted classes, the library caches them under their internally declared names without verifying them against the requested class name. A remote attacker could exploit this vulnerability to substitute legitimate classes with attacker-controlled ones, allowing them to bypass security verification checks and compromise application logic."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-94114", "package_state": [{"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Fix deferred", "package_name": "bcel", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "bcel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "maven-shared-jar", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "bcel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "bazel6", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "bcel", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6", "fix_state": "Fix deferred", "package_name": "jws6-tomcat-jakartaee-migration", "product_name": "Red Hat JBoss Web Server 6"}], "public_date": "2026-10-06T19:42:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-94114\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94114\nhttps://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch\nhttps://lists.apache.org/thread.html/d87nxx7nb5bombqggxhxo9lz16nwtsf9"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires an application to process untrusted or maliciously crafted Java class files, and high attack complexity is needed to influence name lookups in shared class caches. In Red Hat environments, Apache Commons BCEL is primarily used in migration utilities and build tooling rather than in continuously exposed network services processing arbitrary bytecode. Consequently, typical production deployments do not expose the affected class caching mechanism to untrusted input.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.13.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,14890bf2b9014df25f9b4de86f29b5e917e5656b)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Commons BCEL", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "commons_bcel", "vendor": "apache"}], "created": "2026-10-07T01:45:08.760251+00:00", "updated": "2026-10-07T04:00:09.053773+00:00", "vendors": ["apache", "apache$PRODUCT$commons_bcel"]}