AZL-108017
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108017.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-108017
- Upstream
- Published
- 2026-10-06T20:17:34Z
- Modified
- 2026-10-15T05:32:31Z
- Summary
- CVE-2026-94114 affecting package bcel 5.2-37
- Details
-
Symbolic name not mapping to correct class.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons BCEL: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
- References