CVE Intelligence

Apache Software Foundation Apache Commons BCEL vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Apache Software Foundation Apache Commons BCEL: 2 record(s), with affected versions and fixes.

CVE-2026-94114 Medium · 5.9 CWE-386 Oct 6, 2026
Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning
Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.
CVE-2026-105111 Medium · 4.7 CWE-79 Oct 6, 2026
Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.