CVE-2026-94114 — Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Description (CNA)

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Commons BCEL	affected 0 before 6.13.0; affected 0 before 14890bf2b9014df25f9b4de86f29b5e917e5656b

CWE

CWE-386

References

https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch
https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/10/07/12