CVE-2026-94114highCWE-386

CVE-2026-94114: falha de alta gravidade em Apache Commons BCEL

Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Publicada em 06 out 2026 · Atualizada em 08 out 2026

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.3%

probabilidade de exploração

0.3%top 81% das CVEs

exploração observada

nãonenhuma fonte reporta

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Apache Software Foundation · Apache Commons BCEL

CVEs relacionadas — Apache Commons BCEL

No mesmo produto, das mais perigosas para as menos.

CVE-2022-42920—Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writingEPSS 3.0%CVE-2026-105111LOWApache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSSEPSS 0.3%

Referências

https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6 http://www.openwall.com/lists/oss-security/2026/10/07/12