CVE-2022-42920CWE-787

CVE-2022-42920: vulnerability in Apache Commons BCEL

Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

Published · Updated

Follow this CVE+ Monitor Apache Commons BCEL+ Monitor bcel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 3.5%
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
Affected products
Apache Software Foundation · Apache Commons BCEL
Related CVEs — Apache Commons BCEL

In the same product, most dangerous first.

CVE-2026-94114HIGHApache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoningEPSS 0.3%CVE-2026-105111LOWApache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSSEPSS 0.2%