Skip to content
Sign in
5.9 Medium

CVE-2026-94114 Symbolic name not mapping to correct class

Description

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

Affected products and versions

Product Affected versions Fixed in
Apache Commons BCEL 6.13 earliest → < 6.13.0 6.13.0

Other CVEs of Apache Commons BCEL

The 3 CVEs of Apache Commons BCEL →
CVE-2026-105111 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons… 4.7 Medium CVE-2022-42920 Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics Not rated
Track this CVE