Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Apache Commons BCEL 6.13.0 fixes recursion and stored XSS

1 source · 2 articlesFirst reported Updated ()2
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Apache Commons BCEL before 6.13.0 has unbounded ClassParser recursion (CVE-2026-94114) and stored XSS in Class2HTML (CVE-2026-105111).

Apache Commons BCEL before 6.13.0 is affected by two issues reported on 7 October 2026. CVE-2026-94114 lets nested Code or Record attributes drive unbounded parse-time recursion in ClassParser; Apache rates it important, with CVSS 3.1 at 5.9 and CVSS 4.0 at 8.2, and also describes a symbolic-name mapping failure and caching of attacker-controlled classes. CVE-2026-105111 is stored cross-site scripting in Class2HTML, which emits class strings without escaping; Apache rates it low, with CVSS 3.1 at 4.7 and CVSS 4.0 at 2.3, and user interaction is required. Both are fixed in 6.13.0, via commits 14890bf2b9014df25f9b4de86f29b5e917e5656b and fb72c225cbc6ec3d94060ed6edb269f07428d504. The reports do not disagree on the affected versions or the fix.

Key facts
  • CVE-2026-94114 affects Apache Commons BCEL before 6.13.0: nested Code or Record attributes drive unbounded recursion in ClassParser.
  • Apache rates CVE-2026-94114 important; CVSS 3.1 is 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) and CVSS 4.0 is 8.2.
  • Apache describes a symbolic-name mapping failure for CVE-2026-94114 and says BCEL caches attacker-controlled classes.
  • CVE-2026-105111 is stored XSS in Class2HTML before 6.13.0 because class strings are written into generated pages without escaping; user interaction is required.
  • Apache rates CVE-2026-105111 low; CVSS 3.1 is 4.7 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) and CVSS 4.0 is 2.3.
  • Both issues are fixed in Apache Commons BCEL 6.13.0 (commits 14890bf2b9014df25f9b4de86f29b5e917e5656b and fb72c225cbc6ec3d94060ed6edb269f07428d504).
  • Both reports were published on 2026-10-07 and do not conflict on affected versions or the fix release.
Analyze CVE-2026-94114 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-94114CVE-2026-105111
Vendors
Apache Software Foundation
Products
Apache Commons BCELClassParserClass2HTML
Organizations
Apache Software Foundation

Coverage

oldest first · one row per article · UTC
  1. · 19d ago oss-securityFirst report

    CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser

    Apache Commons BCEL before 6.13.0 can recurse unboundedly while parsing nested Code or Record attributes (CVE-2026-94114).

  2. · 19d ago oss-security

    CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

    Apache Commons BCEL Class2HTML before 6.13.0 emits unescaped class strings, enabling stored XSS (CVE-2026-105111).

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-94114
+1 related CVE
CVE-2026-105111
Class-name confusion in Apache Commons BCEL before 6.13.0
8.2
group max
—