{"id":"openSUSE-SU-2026:22109-1","summary":"Security update for bcel","details":"This update for bcel fixes the following issues:\n\n- CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400).\n- CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399).\n\nChanges for bcel:\n\n- Update to version 6.13.0\n * New Features\n + Add support for permitted subclasses\n + Add RecordComponentInfo.getAttribute(byte tag)\n + Add Const.MAJOR_27\n + Add Const.MINOR_27\n + Add and use ArrayType.isElementType(Type)\n + Add Const.MAJOR_28\n + Add Const.MINOR_28\n * Fixed Bugs\n + Fix constant pool module access test on Java 26 and above\n + Deprecate org.apache.bcel.classfile.Utility.Utility()\n + Deprecate org.apache.bcel.verifier.exc.Utility\n .getStackTrace(Throwable)\n + Fix all Javadoc warnings and enforce checks by default\n + Escape constant pool names in generated HTML\n + Escape referenced names in BCELFactory Java output\n + Make wide flag thread-local in Utility.codeToString\n + Read multianewarray dimensions as unsigned byte\n + Site docs: clarify security model\n + Read ConstantDynamic indices as unsigned shorts\n + Validate index upper bound in CPInstruction, IINC and RET\n setIndex\n + Use correct attribute tag in NestHost and ModuleMainClass\n + Propagate runtime-visible flag when parsing parameter\n annotations\n + Use fixedLength for parsed LOOKUPSWITCH length\n + Fix ConstantPoolGen dedup key collisions for names with\n delimiters\n + Read unsigned bytecode operands in CodeHTML disassembler\n + Deep-copy bootstrap arguments array in BootstrapMethod.copy()\n + Use exclusive live-range end in LocalVariableTable\n .getLocalVariable\n + Build TABLESWITCH from sorted arrays in SWITCH\n + Use array element type not basic type for primitive array\n access\n + Set length in INVOKEDYNAMIC constructor\n + Reject CALOAD on non-char arrays in structural verification\n + Add negative verifier tests for remaining array load/store\n component type checks\n + Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY\n + Match wide local variable instruction length to dumped bytes\n + Bound IINC increment to signed short\n + Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8\n + Nested Code/Record attributes drive unbounded parse-time\n recursion in ClassParser\n + Nested annotation element values recurse unboundedly;\n MAX_ARRAY_DIMENSIONS cap bypassed\n + Opcodes tableswitch and lookupswitch add boundary checks\n + JustIce Pass 2 hangs on cyclic superclass chain of a\n referenced exception class\n + JustIce Pass 2 LVT check amplifies each 10-byte entry into\n ~131k hashtable operations\n + Pass 3b dataflow stores frames per instruction and clones\n ever-growing execution chains\n + Cubic handlers * range * subroutines scan in Subroutines\n constructor hangs JustIce Pass 3b\n + Subroutines.noRecursiveCalls enumerates exponentially many JSR\n call paths\n + Disassembler and Class2HTML re-implement the unchecked\n switch-table allocation\n + ConstantPool.constantToString recurses forever on\n self-referencing CONSTANT_MethodHandle\n + Utility.typeSignatureToString recurses per generic-nesting\n level, unbounded, with quadratic substring copies\n + Repositories cache classes under the input-defined this_class\n name; global static Repository/VerifierFactory make the\n poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114)\n + Silent u2/u1 count truncation across dump paths corrupts\n emitted bytecode\n + Class2HTML emitters write attacker class-file strings into\n HTML unescaped (stored XSS in reports) (bsc#1284399,\n CVE-2026-105111)\n + Class2HTML builds output file paths from the unvalidated class\n name\n + ClassPath.getBytes() sizes its buffer from the forged ZIP\n uncompressed-size field\n + PMG attribute ignores declared length, enabling BCEL-vs-JVM\n parse divergence\n + Signature.matchGJIdent recurses unboundedly on nested generic\n signatures (Signature.translate)\n + Utility.decode fixed 3x buffer breaks the encode/decode round\n trip and throws unchecked AIOOBE\n + BCELifier interpolates attacker class/package names into\n generated Java source unescaped\n + Verifier pass 3a delayed checks are quadratic in attribute and\n code size\n + Verifier cache grows unboundedly with attacker-chosen class\n names\n + Static WIDE ThreadLocal survives exceptions, corrupting the\n next class's disassembly on the same thread\n + Utility.JavaReader escape decoding: OOB table index, bad-hex\n crash, silent non-canonical aliasing\n * Changes\n + Bump org.apache.commons:commons-parent from 95 to 104\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20\n + Bump commons-io:commons-io from 2.21.0 to 2.22.0\n + Bump jna.version from 5.18.1 to 5.19.1\n + [test] Bump org.apache.commons:commons-collections4 from 4.5.0\n to 4.6.0\n- Changes of version 6.12.0\n + Add Const.MAJOR_26\n + Add Const.MINOR_26\n + Fix infinite loop in example.TransitiveHull\n + Fix Apache RAT plugin console warnings\n + Fix malformed Javadoc comments\n + Make the build reproducible on the Azul JDK\n + Fix infinite loop in JavaClass.findField() on invalid input\n + Fix infinite loop in JavaClass.getAllInterfaces() on invalid\n input\n + Fix infinite loop in JavaClass.getSuperClasses() on invalid\n + Exception message in Args.requireU4() refers to the wrong data\n type\n + Exception message in Args.requireU2() refers to the wrong\n upper range value\n + Code.Code(int, int, DataInput, ConstantPool) now throws a\n ClassFormatException if the code array is greater than the\n JVM specification allows\n + Code.Code(int, int, int, int, byte[], CodeException[],\n Attribute[], ConstantPool) now throws a ClassFormatException\n if the code array is greater than the JVM specification allows\n + Code.setCode(byte[]) now throws a ClassFormatException if the\n code array is greater than the JVM specification allows\n + ClassDumper.dump() should not call the input stream it didn't\n open; fixes IOException when calling DumpClass.main\n (ClassDumper.java:351)\n + org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[])\n now uses varagrs: ConstantPool(Constant...)\n + org.apache.bcel.classfile.Deprecated now requires its the\n attribute_length item be zero\n + org.apache.bcel.classfile.Synthetic now requires its the\n + The size of an Attribute unknown to the JVM specification is\n limited to 1 MB and is overridden with the system property\n BCEL.Attribute.Unknown.max_attribute_length\n + Bump org.apache.commons:commons-parent from 89 to 95\n + [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to\n 2.3.0\n + Bump commons-io:commons-io from 2.20.0 to 2.21.0\n + Bump commons-lang3 from 3.19.0 to 3.20.0\n + [test] Bump org.apache.commons:commons-exec from 1.5.0 to\n 1.6.0\n- Changes of version 6.11.0\n + Add Const.MAJOR_25\n + Add Const.MINOR_25\n + Add experimental CycloneDX VEX file\n + Refactor to use new Maven POM variable ecj.version\n + Replace internal use of Locale.ENGLISH with Locale.ROOT\n + BCEL-375: Wrong permissions on bcel .jar file in binary\n .tar.gz distribution file\n + BCEL-376: ClassPath.close() throws\n UnsupportedOperationException when created with\n system-classpath\n + ClassPath.getResources(String) can use an ArrayList instead of\n a Vector\n + Fix SpotBugs [ERROR] Medium: Operation on the \"created\" shared\n variable in \"ConstantUtf8\" class is not atomic [org.apache\n .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119]\n AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE\n + Fix SpotBugs [ERROR] Medium: Operation on the \"considered\"\n shared variable in \"ConstantUtf8\" class is not atomic [org\n .apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:\n [line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE\n + Fix SpotBugs [ERROR] Medium: Operation on the \"skipped\" shared\n .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134]\n + org.apache.bcel.util.ClassPath\n .addJdkModules(String, List\u003cString\u003e) now reads the system\n property \"jdk.module.path\" instead of \"java.modules.path\"\n + Fix ConstantPoolModuleAccessTest failures on Java 25\n + 377: Fix testing on Java 24 and up\n + Bump org.apache.commons:commons-parent from 72 to 89\n + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20\n + Bump commons-io:commons-io from 2.16.1 to 2.20.0\n + Bump jna.version from 5.14.0 to 5.18.1\n + Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to\n 3.2.1\n + Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to\n 4.5.0\n + Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0\n a minimum of Java 8\n + Fix PMD UnnecessaryFullyQualifiedName\n + Fix PMD EmptyCatchBlock by allowing commented blocks\n + Fix PMD EmptyControlStatement by allowing commented blocks\n JasminVisitor\n + SpotBugs checks should ignore code generated by JavaCC\n + Fix SpotBugs URF_UNREAD_FIELD in ClassDumper\n + Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor\n ASTFunAppl\n Mini.Environment\n + Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC\n + Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[])\n TransitiveHull.getIgnored()\n + Add accessors to model and unit tests, Javadoc\n + Add Const.MAJOR_22\n + Add Const.MINOR_22\n + Add Const.MAJOR_23\n + Add Const.MINOR_23\n + Add Const.MAJOR_24\n + Add Const.MINOR_24\n 2.0.0\n to 4.5.0-M2\n + Bump org.apache.commons:commons-parent from 69 to 71\n 3.1.0\n * Includes changes from 6.9.0 Maintenance and bug fix release\n + Add Support for Java 16 records\n + Add null guard for InstructionFactory.createInvoke()\n + Avoid possible NullPointerException in\n org.apache.bcel.classfile.DescendingVisitor.accept(E[])\n AnnotationEntryGen[])\n ConstantPoolGen, boolean)\n ElementValue[], ConstantPoolGen)\n org.apache.bcel.generic.ClassGen.setMethods(Method[])\n + Avoid possible NullPointerException in org.apache.bcel.generic\n .ClassGen.unpackAnnotations(Attribute[])\n + Avoid possible NullPointerException in org.apache.bcel\n .classfile.ParameterAnnotationEntry\n .createParameterAnnotationEntries(Attribute[])\n org.apache.bcel.generic.ClassGen.ClassGen(JavaClass)\n .FieldGenOrMethodGen.addAll(Attribute[])\n + Avoid NullPointerException after calling org.apache.bcel\n .classfile.MethodParameters.setParameters(MethodParameter[])\n with null\n .classfile.ParameterAnnotations\n .setParameterAnnotationTable(ParameterAnnotationEntry[])\n .classfile.LocalVariableTypeTable\n .setLocalVariableTable(LocalVariable[]) with null\n .classfile.LocalVariableTable\n .classfile.LineNumberTable.setLineNumberTable(LineNumber[])\n .classfile.JavaClass.setMethods(Method[] with null\n .classfile.JavaClass.setInterfaces(int[]) with null\n .classfile.JavaClass.setInterfaceNames(String[]) with null\n .classfile.JavaClass.setFields(Field[]) with null\n .classfile.JavaClass.setAttributes(Attribute[]) with null\n .classfile.ConstantPool.setConstantPool(Constant[]) with null\n .classfile.FieldOrMethod.setAttributes(Attribute[]) with null\n .classfile.Annotations.setAnnotationTable(AnnotationEntry[])\n .classfile.ArrayElementValue.ArrayElementValue(int,\n ElementValue[], ConstantPool) with null\n .classfile.BootstrapMethod.BootstrapMethod(int, int[]) with\n null\n .classfile.BootstrapMethod.setBootstrapArguments(int[]) with\n .classfile.BootstrapMethods.BootstrapMethods(int, int,\n BootstrapMethod[], ConstantPool) with null\n .classfile.BootstrapMethods\n .setBootstrapMethods(BootstrapMethod[]) with null\n + Avoid NullPointerException calling org.apache.bcel.generic\n .InstructionList.redirectLocalVariables(LocalVariableGen[],\n InstructionHandle, InstructionHandle) with null\n .InstructionList.redirectExceptionHandlers(CodeExceptionGen[],\n .InstructionList.findHandle(InstructionHandle[], int[], int,\n int) with null\n .MethodGen.setArgumentTypes(Type[]) with null\n .MethodGen.setArgumentNames(String[]) with null\n .MethodGen.removeRuntimeAttributes(Attribute[]) with null\n .MethodGen.makeMutableVersion(AnnotationEntry[]) with null\n + Bump org.apache.commons:commons-parent from 66 to 69\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23\n + Bump commons-io:commons-io from 2.15.1 to 2.16.1\n * 6.8.0 (2023-12-08) Maintenance and bug fix release\n ClassFormatException\n input Java4Example\n ~ Add verifier tests on some opcodes\n signatures\n ~ Add Const.MAJOR_20\n ~ Add Const.MINOR_20\n ~ Add Const.MAJOR_21\n ~ Add Const.MINOR_21\n ~ [Bcelifier] stackmap support to pass JDK verifier\n SE_BAD_FIELD\n BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH\n NullPointerException\n not a NullPointerException\n ~ Test and coverage of InstructionFactory\n ~ Verifier: test and coverage for SWAP instruction\n () in it`()'\n ~ Fix null pointers in AnnotationEntry\n supports package-private)\n test\n ATHROW on empty stack\n Select#toString(boolean)\n ~ Fix EmptyVisitorTestCase on Java 21\n ~ Bump commons-parent from 54 to 65\n ~ Bump jna.version from 5.12.1 to 5.13.0\n ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21\n ~ Bump commons-io from 2.11.0 to 2.15.1\n ~ Bump commons-lang3 from 3.12.0 to 3.14.0\n 3.1.1\n * 6.7.0 (2022-11-28) Maintenance and bug fix release\n * 6.6.1 (2022-10-29) Maintenance and bug fix release\n * 6.6.0 (2022-10-08) Minor feature and bug fix release\n * 6.5.0 (2020-06-05) Minor feature and bug fix release\n * 6.4.1 (2019-09-26) Bug fix release\n * 6.4.0 (2019-09-20) Feature and bug fix release\n requires Java 7 or higher to run\n class\n org.apache.bcel.generic.InstructionConsts class\n java.lang.String\n","modified":"2026-10-19T17:23:15.937624643Z","published":"2026-10-16T12:21:25Z","related":["CVE-2026-105111","CVE-2026-94114"],"upstream":["CVE-2026-105111","CVE-2026-94114"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284399"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284400"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-105111"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-94114"}],"affected":[{"package":{"name":"bcel","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/bcel&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"bcel":"6.13.0-160000.1.1","bcel-javadoc":"6.13.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22109-1.json"}}],"schema_version":"1.9.0"}