CVE-2026-94114

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-94114
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94114.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-94114
Downstream
Related
Published
2026-10-06T19:42:30Z
Modified
2026-10-09T17:26:55Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning
Details

Symbolic name not mapping to correct class.

BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.

This issue affects Apache Commons BCEL: before 6.13.0.

Users are recommended to upgrade to version 6.13.0, which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-386"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94114.json"
}
References

Affected packages

Git / gitbox.apache.org/repos/asf/commons-bcel.git

Affected ranges

Type
GIT
Repo
https://gitbox.apache.org/repos/asf/commons-bcel.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
14890bf2b9014df25f9b4de86f29b5e917e5656b
Type
GIT
Repo
https://github.com/apache/commons-bcel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
be4bc45e5ee623b4d074a0b0888da828822dd9b3
Fixed
14890bf2b9014df25f9b4de86f29b5e917e5656b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.13.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

commons-bcel-6.*
commons-bcel-6.3.1
commons-bcel-6.3.1-RC1
commons-bcel-6.4.0-RC1
commons-bcel-6.4.0-RC2
commons-bcel-6.4.1-RC1
commons-bcel-6.5.0-RC1
commons-bcel-6.6.0-RC1
commons-bcel-6.8.0-RC1
commons-bcel-6.8.1-RC1
rel/commons-bcel-6.*
rel/commons-bcel-6.4.0
rel/commons-bcel-6.4.1
rel/commons-bcel-6.5.0
rel/commons-bcel-6.6.0
rel/commons-bcel-6.8.0
rel/commons-bcel-6.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94114.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "220297681848997192773720718819399327125",
                "120812706255331019386190384473820656895",
                "264466697646792715054021489095437633285",
                "124154992449439215803352419146204979128",
                "206550560170549858109044754719753958136",
                "210037967611658782912888850522913364483",
                "87433040440797791542030200428871725868",
                "317497572778181104536728023686270244196",
                "142781953660353246535907392650604540677",
                "198751055866774955631243510199289809579"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94114-18a63b2e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/generic/GeneratingAnnotatedClassesTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "209206361225323469452567779139605647177",
            "length": 699
        },
        "id": "CVE-2026-94114-35e53994",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/generic/FieldAnnotationsTest.java",
            "function": "testFieldAnnotationEntrysReadWrite"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "276927026946046717890671077162909721446",
                "128965718924706673245918143177186380378",
                "294492218118455926941116028151139476287",
                "329902594124956910617897345263660095936",
                "216856158786057529399476849450865168171",
                "85572908606179072683322701402625717556",
                "229853524553835346933553622135016487923",
                "124834332151189585453101125227529475928"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94114-3cf6a7c4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/EnclosingMethodAttributeTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "209206361225323469452567779139605647177",
            "length": 699
        },
        "id": "CVE-2026-94114-4eb0695f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/generic/FieldAnnotationsTest.java",
            "function": "testFieldAnnotationEntrysReadWrite"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "8527464519352100152399077429411481377",
            "length": 518
        },
        "id": "CVE-2026-94114-4fdbd92a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/generic/GeneratingAnnotatedClassesTest.java",
            "function": "testModifyingClasses2"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "110935639645834492421433907942958686481",
                "280978159541043743000575399650520171592",
                "22824960260269732736122631878555868613",
                "259188036600123268360590718056463175970"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94114-5dca2290",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/main/java/org/apache/bcel/util/ClassLoaderRepository.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "16152935787811921487901765766817738122",
                "22346632007061562685307249639385736116",
                "164274690684237736651203776123770423959",
                "112582337781729903683219346440309765301"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94114-66b423d7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/main/java/org/apache/bcel/util/AbstractClassPathRepository.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "276927026946046717890671077162909721446",
                "128965718924706673245918143177186380378",
                "294492218118455926941116028151139476287",
                "329902594124956910617897345263660095936",
                "216856158786057529399476849450865168171",
                "85572908606179072683322701402625717556",
                "229853524553835346933553622135016487923",
                "124834332151189585453101125227529475928"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94114-69d41785",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/EnclosingMethodAttributeTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "53730856287106878213816251560192446675",
            "length": 414
        },
        "id": "CVE-2026-94114-6d30753d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/main/java/org/apache/bcel/util/AbstractClassPathRepository.java",
            "function": "loadClass"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "332574134490707635962467323339890174613",
            "length": 512
        },
        "id": "CVE-2026-94114-6f03d42f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/main/java/org/apache/bcel/util/ClassLoaderRepository.java",
            "function": "loadClass"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "69114282081018815947500587814640243242",
                "262233279636240179114640097995122364644",
                "59640901040940923794608886377017944500",
                "30338064065016072352633788597931285799",
                "177789069592562720946908447191850478163",
                "269450735648933494498009873486594144168",
                "6487561933908019474411209264893433205",
                "322222315152859434370094535768964355554",
                "257404768294101013035297193463496719786",
                "28156842367098244784513313225031987078"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94114-6fcad039",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/generic/FieldAnnotationsTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "8527464519352100152399077429411481377",
            "length": 518
        },
        "id": "CVE-2026-94114-74a7b21a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/generic/GeneratingAnnotatedClassesTest.java",
            "function": "testModifyingClasses2"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "332574134490707635962467323339890174613",
            "length": 512
        },
        "id": "CVE-2026-94114-8372be61",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/main/java/org/apache/bcel/util/ClassLoaderRepository.java",
            "function": "loadClass"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "83939620448142564928215306478869908549",
            "length": 858
        },
        "id": "CVE-2026-94114-9babfa7c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/EnclosingMethodAttributeTest.java",
            "function": "testAttributeSerializtion"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "53730856287106878213816251560192446675",
            "length": 414
        },
        "id": "CVE-2026-94114-9bf9fa53",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/main/java/org/apache/bcel/util/AbstractClassPathRepository.java",
            "function": "loadClass"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "83939620448142564928215306478869908549",
            "length": 858
        },
        "id": "CVE-2026-94114-a7e155d8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/EnclosingMethodAttributeTest.java",
            "function": "testAttributeSerializtion"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "16152935787811921487901765766817738122",
                "22346632007061562685307249639385736116",
                "164274690684237736651203776123770423959",
                "112582337781729903683219346440309765301"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94114-b6d228ec",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/main/java/org/apache/bcel/util/AbstractClassPathRepository.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "110935639645834492421433907942958686481",
                "280978159541043743000575399650520171592",
                "22824960260269732736122631878555868613",
                "259188036600123268360590718056463175970"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94114-dd179430",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/main/java/org/apache/bcel/util/ClassLoaderRepository.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "220297681848997192773720718819399327125",
                "120812706255331019386190384473820656895",
                "264466697646792715054021489095437633285",
                "124154992449439215803352419146204979128",
                "206550560170549858109044754719753958136",
                "210037967611658782912888850522913364483",
                "87433040440797791542030200428871725868",
                "317497572778181104536728023686270244196",
                "142781953660353246535907392650604540677",
                "198751055866774955631243510199289809579"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94114-e59ef0bf",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/generic/GeneratingAnnotatedClassesTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "69114282081018815947500587814640243242",
                "262233279636240179114640097995122364644",
                "59640901040940923794608886377017944500",
                "30338064065016072352633788597931285799",
                "177789069592562720946908447191850478163",
                "269450735648933494498009873486594144168",
                "6487561933908019474411209264893433205",
                "322222315152859434370094535768964355554",
                "257404768294101013035297193463496719786",
                "28156842367098244784513313225031987078"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94114-ebe00576",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://gitbox.apache.org/repos/asf/commons-bcel.git@14890bf2b9014df25f9b4de86f29b5e917e5656b",
        "target": {
            "file": "src/test/java/org/apache/bcel/generic/FieldAnnotationsTest.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-09T07:06:06Z"