CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser
Apache Commons BCEL before 6.13.0 can recurse unboundedly while parsing nested Code or Record attributes (CVE-2026-94114).
Apache Commons BCEL before 6.13.0 is affected by CVE-2026-94114, where nested Code or Record attributes drive unbounded recursion in ClassParser. Apache describes a symbolic-name mapping failure and says BCEL caches attacker-controlled classes. Rated important, CVSS 3.1 is 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) and CVSS 4.0 is 8.2. The fix is 6.13.0 and commit 14890bf2b9014df25f9b4de86f29b5e917e5656b.
- CVE-2026-94114 causes unbounded ClassParser recursion on nested Code or Record attributes.
- Apache rates it important; CVSS 4.0 is 8.2 with high integrity impact.
- CVSS 3.1 is 5.9 (high attack complexity, no availability impact scored).
- BCEL can cache attacker-controlled classes; fixed in 6.13.0.
- CVEs
- CVE-2026-94114
- Vendors
- Apache Software Foundation
- Products
- Apache Commons BCELClassParser
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94114 | Class-name confusion in Apache Commons BCEL before 6.13.0 | 8.2 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 14890bf2b9014df25f9b4de86f29b5e917e5656b | che Commons BCEL before 6.13.0 - Apache Commons BCEL before 14890bf2b9014df25f9b4de86f29b5e917e5656b Description: Symbolic name not mapping to correct object vu |
From the original article
Posted by Gary D. Gregory on Oct 06 Severity: important CVSS 3. 1: 5.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.