CVE-2026-94114

Apache Commons BCEL before 6.13.0 caches attacker-controlled classes under the names those classes declare for themselves, without checking that the declared name matches the name that was requested. Later lookups and name-keyed verification can therefore refer to a different class than the caller asked for (CWE-386, symbolic name not mapping to the correct object). An attacker who can supply class bytes that BCEL processes may undermine class-identity checks; the issue is rated high (CVSS 4.0 8.2) with high integrity impact and no confidentiality or availability impact on the vulnerable system. Applications and tools that use affected BCEL releases and handle untrusted bytecode are potentially affected. There is no known public proof of concept, and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog.

What to do: Upgrade Apache Commons BCEL to 6.13.0 or later and rebuild or redeploy anything that still ships an older jar, including transitive dependencies. Prioritize applications that load or verify untrusted bytecode through BCEL.