{"id":"CVE-2026-94114","summary":"Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning","details":"Symbolic name not mapping to correct class.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.","modified":"2026-10-09T17:26:55.036565426Z","published":"2026-10-06T19:42:30.421Z","related":["openSUSE-SU-2026:12080-1"],"database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-386"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94114.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/07/12"},{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94114.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94114"},{"type":"FIX","url":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch"},{"type":"PACKAGE","url":"https://gitbox.apache.org/repos/asf/commons-bcel.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitbox.apache.org/repos/asf/commons-bcel.git","events":[{"introduced":"0"},{"fixed":"14890bf2b9014df25f9b4de86f29b5e917e5656b"}]},{"type":"GIT","repo":"https://github.com/apache/commons-bcel","events":[{"introduced":"0"},{"fixed":"be4bc45e5ee623b4d074a0b0888da828822dd9b3"},{"fixed":"14890bf2b9014df25f9b4de86f29b5e917e5656b"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"6.13.0"}]}}],"versions":["rel/commons-bcel-6.8.1","commons-bcel-6.8.1-RC1","rel/commons-bcel-6.8.0","commons-bcel-6.8.0-RC1","rel/commons-bcel-6.6.0","commons-bcel-6.6.0-RC1","rel/commons-bcel-6.5.0","commons-bcel-6.5.0-RC1","rel/commons-bcel-6.4.1","commons-bcel-6.4.1-RC1","rel/commons-bcel-6.4.0","commons-bcel-6.4.0-RC2","commons-bcel-6.4.0-RC1","commons-bcel-6.3.1","commons-bcel-6.3.1-RC1"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/test/java/org/apache/bcel/generic/GeneratingAnnotatedClassesTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["220297681848997192773720718819399327125","120812706255331019386190384473820656895","264466697646792715054021489095437633285","124154992449439215803352419146204979128","206550560170549858109044754719753958136","210037967611658782912888850522913364483","87433040440797791542030200428871725868","317497572778181104536728023686270244196","142781953660353246535907392650604540677","198751055866774955631243510199289809579"]},"id":"CVE-2026-94114-18a63b2e","signature_type":"Line","signature_version":"v1"},{"digest":{"length":699,"function_hash":"209206361225323469452567779139605647177"},"id":"CVE-2026-94114-35e53994","signature_type":"Function","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/test/java/org/apache/bcel/generic/FieldAnnotationsTest.java","function":"testFieldAnnotationEntrysReadWrite"},"deprecated":false},{"target":{"file":"src/test/java/org/apache/bcel/EnclosingMethodAttributeTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["276927026946046717890671077162909721446","128965718924706673245918143177186380378","294492218118455926941116028151139476287","329902594124956910617897345263660095936","216856158786057529399476849450865168171","85572908606179072683322701402625717556","229853524553835346933553622135016487923","124834332151189585453101125227529475928"]},"id":"CVE-2026-94114-3cf6a7c4","signature_type":"Line","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b"},{"deprecated":false,"digest":{"function_hash":"209206361225323469452567779139605647177","length":699},"id":"CVE-2026-94114-4eb0695f","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/test/java/org/apache/bcel/generic/FieldAnnotationsTest.java","function":"testFieldAnnotationEntrysReadWrite"}},{"signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/test/java/org/apache/bcel/generic/GeneratingAnnotatedClassesTest.java","function":"testModifyingClasses2"},"deprecated":false,"digest":{"function_hash":"8527464519352100152399077429411481377","length":518},"id":"CVE-2026-94114-4fdbd92a","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["110935639645834492421433907942958686481","280978159541043743000575399650520171592","22824960260269732736122631878555868613","259188036600123268360590718056463175970"],"threshold":0.9},"id":"CVE-2026-94114-5dca2290","signature_type":"Line","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/main/java/org/apache/bcel/util/ClassLoaderRepository.java"}},{"signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/main/java/org/apache/bcel/util/AbstractClassPathRepository.java"},"deprecated":false,"digest":{"line_hashes":["16152935787811921487901765766817738122","22346632007061562685307249639385736116","164274690684237736651203776123770423959","112582337781729903683219346440309765301"],"threshold":0.9},"id":"CVE-2026-94114-66b423d7","signature_type":"Line"},{"id":"CVE-2026-94114-69d41785","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/test/java/org/apache/bcel/EnclosingMethodAttributeTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["276927026946046717890671077162909721446","128965718924706673245918143177186380378","294492218118455926941116028151139476287","329902594124956910617897345263660095936","216856158786057529399476849450865168171","85572908606179072683322701402625717556","229853524553835346933553622135016487923","124834332151189585453101125227529475928"]}},{"signature_type":"Function","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/main/java/org/apache/bcel/util/AbstractClassPathRepository.java","function":"loadClass"},"deprecated":false,"digest":{"function_hash":"53730856287106878213816251560192446675","length":414},"id":"CVE-2026-94114-6d30753d"},{"id":"CVE-2026-94114-6f03d42f","signature_type":"Function","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/main/java/org/apache/bcel/util/ClassLoaderRepository.java","function":"loadClass"},"deprecated":false,"digest":{"function_hash":"332574134490707635962467323339890174613","length":512}},{"signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/test/java/org/apache/bcel/generic/FieldAnnotationsTest.java"},"deprecated":false,"digest":{"line_hashes":["69114282081018815947500587814640243242","262233279636240179114640097995122364644","59640901040940923794608886377017944500","30338064065016072352633788597931285799","177789069592562720946908447191850478163","269450735648933494498009873486594144168","6487561933908019474411209264893433205","322222315152859434370094535768964355554","257404768294101013035297193463496719786","28156842367098244784513313225031987078"],"threshold":0.9},"id":"CVE-2026-94114-6fcad039","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"function":"testModifyingClasses2","file":"src/test/java/org/apache/bcel/generic/GeneratingAnnotatedClassesTest.java"},"deprecated":false,"digest":{"function_hash":"8527464519352100152399077429411481377","length":518},"id":"CVE-2026-94114-74a7b21a","signature_type":"Function"},{"digest":{"function_hash":"332574134490707635962467323339890174613","length":512},"id":"CVE-2026-94114-8372be61","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"function":"loadClass","file":"src/main/java/org/apache/bcel/util/ClassLoaderRepository.java"},"deprecated":false},{"source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/test/java/org/apache/bcel/EnclosingMethodAttributeTest.java","function":"testAttributeSerializtion"},"deprecated":false,"digest":{"length":858,"function_hash":"83939620448142564928215306478869908549"},"id":"CVE-2026-94114-9babfa7c","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/main/java/org/apache/bcel/util/AbstractClassPathRepository.java","function":"loadClass"},"deprecated":false,"digest":{"length":414,"function_hash":"53730856287106878213816251560192446675"},"id":"CVE-2026-94114-9bf9fa53","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"83939620448142564928215306478869908549","length":858},"id":"CVE-2026-94114-a7e155d8","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/test/java/org/apache/bcel/EnclosingMethodAttributeTest.java","function":"testAttributeSerializtion"},"deprecated":false},{"id":"CVE-2026-94114-b6d228ec","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/main/java/org/apache/bcel/util/AbstractClassPathRepository.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["16152935787811921487901765766817738122","22346632007061562685307249639385736116","164274690684237736651203776123770423959","112582337781729903683219346440309765301"]}},{"deprecated":false,"digest":{"line_hashes":["110935639645834492421433907942958686481","280978159541043743000575399650520171592","22824960260269732736122631878555868613","259188036600123268360590718056463175970"],"threshold":0.9},"id":"CVE-2026-94114-dd179430","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/main/java/org/apache/bcel/util/ClassLoaderRepository.java"}},{"deprecated":false,"digest":{"line_hashes":["220297681848997192773720718819399327125","120812706255331019386190384473820656895","264466697646792715054021489095437633285","124154992449439215803352419146204979128","206550560170549858109044754719753958136","210037967611658782912888850522913364483","87433040440797791542030200428871725868","317497572778181104536728023686270244196","142781953660353246535907392650604540677","198751055866774955631243510199289809579"],"threshold":0.9},"id":"CVE-2026-94114-e59ef0bf","signature_type":"Line","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/test/java/org/apache/bcel/generic/GeneratingAnnotatedClassesTest.java"}},{"source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b","target":{"file":"src/test/java/org/apache/bcel/generic/FieldAnnotationsTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["69114282081018815947500587814640243242","262233279636240179114640097995122364644","59640901040940923794608886377017944500","30338064065016072352633788597931285799","177789069592562720946908447191850478163","269450735648933494498009873486594144168","6487561933908019474411209264893433205","322222315152859434370094535768964355554","257404768294101013035297193463496719786","28156842367098244784513313225031987078"]},"id":"CVE-2026-94114-ebe00576","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-09T07:06:06Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94114.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}