openSUSE-SU-2026:22109-1

This update for bcel fixes the following issues:

• CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400).
• CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399).

Changes for bcel:

• Update to version 6.13.0

• New Features

• Add support for permitted subclasses
• Add RecordComponentInfo.getAttribute(byte tag)
• Add Const.MAJOR_27
• Add Const.MINOR_27
• Add and use ArrayType.isElementType(Type)
• Add Const.MAJOR_28
• Add Const.MINOR_28

• Fixed Bugs

• Fix constant pool module access test on Java 26 and above
• Deprecate org.apache.bcel.classfile.Utility.Utility()
• Deprecate org.apache.bcel.verifier.exc.Utility .getStackTrace(Throwable)
• Fix all Javadoc warnings and enforce checks by default
• Escape constant pool names in generated HTML
• Escape referenced names in BCELFactory Java output
• Make wide flag thread-local in Utility.codeToString
• Read multianewarray dimensions as unsigned byte
• Site docs: clarify security model
• Read ConstantDynamic indices as unsigned shorts
• Validate index upper bound in CPInstruction, IINC and RET setIndex
• Use correct attribute tag in NestHost and ModuleMainClass
• Propagate runtime-visible flag when parsing parameter annotations
• Use fixedLength for parsed LOOKUPSWITCH length
• Fix ConstantPoolGen dedup key collisions for names with delimiters
• Read unsigned bytecode operands in CodeHTML disassembler
• Deep-copy bootstrap arguments array in BootstrapMethod.copy()
• Use exclusive live-range end in LocalVariableTable .getLocalVariable
• Build TABLESWITCH from sorted arrays in SWITCH
• Use array element type not basic type for primitive array access
• Set length in INVOKEDYNAMIC constructor
• Reject CALOAD on non-char arrays in structural verification
• Add negative verifier tests for remaining array load/store component type checks
• Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY
• Match wide local variable instruction length to dumped bytes
• Bound IINC increment to signed short
• Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8
• Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser
• Nested annotation element values recurse unboundedly; MAX_ARRAY_DIMENSIONS cap bypassed
• Opcodes tableswitch and lookupswitch add boundary checks
• JustIce Pass 2 hangs on cyclic superclass chain of a referenced exception class
• JustIce Pass 2 LVT check amplifies each 10-byte entry into ~131k hashtable operations
• Pass 3b dataflow stores frames per instruction and clones ever-growing execution chains
• Cubic handlers * range * subroutines scan in Subroutines constructor hangs JustIce Pass 3b
• Subroutines.noRecursiveCalls enumerates exponentially many JSR call paths
• Disassembler and Class2HTML re-implement the unchecked switch-table allocation
• ConstantPool.constantToString recurses forever on self-referencing CONSTANT_MethodHandle
• Utility.typeSignatureToString recurses per generic-nesting level, unbounded, with quadratic substring copies
• Repositories cache classes under the input-defined this_class name; global static Repository/VerifierFactory make the poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114)
• Silent u2/u1 count truncation across dump paths corrupts emitted bytecode
• Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports) (bsc#1284399, CVE-2026-105111)
• Class2HTML builds output file paths from the unvalidated class name
• ClassPath.getBytes() sizes its buffer from the forged ZIP uncompressed-size field
• PMG attribute ignores declared length, enabling BCEL-vs-JVM parse divergence
• Signature.matchGJIdent recurses unboundedly on nested generic signatures (Signature.translate)
• Utility.decode fixed 3x buffer breaks the encode/decode round trip and throws unchecked AIOOBE
• BCELifier interpolates attacker class/package names into generated Java source unescaped
• Verifier pass 3a delayed checks are quadratic in attribute and code size
• Verifier cache grows unboundedly with attacker-chosen class names
• Static WIDE ThreadLocal survives exceptions, corrupting the next class's disassembly on the same thread
• Utility.JavaReader escape decoding: OOB table index, bad-hex crash, silent non-canonical aliasing

• Changes

• Bump org.apache.commons:commons-parent from 95 to 104
• Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20
• Bump commons-io:commons-io from 2.21.0 to 2.22.0
• Bump jna.version from 5.18.1 to 5.19.1
• [test] Bump org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0

• Changes of version 6.12.0

• Add Const.MAJOR_26
• Add Const.MINOR_26
• Fix infinite loop in example.TransitiveHull
• Fix Apache RAT plugin console warnings
• Fix malformed Javadoc comments
• Make the build reproducible on the Azul JDK
• Fix infinite loop in JavaClass.findField() on invalid input
• Fix infinite loop in JavaClass.getAllInterfaces() on invalid input
• Fix infinite loop in JavaClass.getSuperClasses() on invalid
• Exception message in Args.requireU4() refers to the wrong data type
• Exception message in Args.requireU2() refers to the wrong upper range value
• Code.Code(int, int, DataInput, ConstantPool) now throws a ClassFormatException if the code array is greater than the JVM specification allows
• Code.Code(int, int, int, int, byte[], CodeException[], Attribute[], ConstantPool) now throws a ClassFormatException if the code array is greater than the JVM specification allows
• Code.setCode(byte[]) now throws a ClassFormatException if the code array is greater than the JVM specification allows
• ClassDumper.dump() should not call the input stream it didn't open; fixes IOException when calling DumpClass.main (ClassDumper.java:351)
• org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[]) now uses varagrs: ConstantPool(Constant...)
• org.apache.bcel.classfile.Deprecated now requires its the attribute_length item be zero
• org.apache.bcel.classfile.Synthetic now requires its the
• The size of an Attribute unknown to the JVM specification is limited to 1 MB and is overridden with the system property BCEL.Attribute.Unknown.max_attribute_length
• Bump org.apache.commons:commons-parent from 89 to 95
• [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to 2.3.0
• Bump commons-io:commons-io from 2.20.0 to 2.21.0
• Bump commons-lang3 from 3.19.0 to 3.20.0
• [test] Bump org.apache.commons:commons-exec from 1.5.0 to 1.6.0

• Changes of version 6.11.0

• Add Const.MAJOR_25
• Add Const.MINOR_25
• Add experimental CycloneDX VEX file
• Refactor to use new Maven POM variable ecj.version
• Replace internal use of Locale.ENGLISH with Locale.ROOT
• BCEL-375: Wrong permissions on bcel .jar file in binary .tar.gz distribution file
• BCEL-376: ClassPath.close() throws UnsupportedOperationException when created with system-classpath
• ClassPath.getResources(String) can use an ArrayList instead of a Vector
• Fix SpotBugs [ERROR] Medium: Operation on the "created" shared variable in "ConstantUtf8" class is not atomic [org.apache .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE
• Fix SpotBugs [ERROR] Medium: Operation on the "considered" shared variable in "ConstantUtf8" class is not atomic [org .apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java: [line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE
• Fix SpotBugs [ERROR] Medium: Operation on the "skipped" shared .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134]
• org.apache.bcel.util.ClassPath .addJdkModules(String, List) now reads the system property "jdk.module.path" instead of "java.modules.path"
• Fix ConstantPoolModuleAccessTest failures on Java 25
• 377: Fix testing on Java 24 and up
• Bump org.apache.commons:commons-parent from 72 to 89
• Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0
• Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20
• Bump commons-io:commons-io from 2.16.1 to 2.20.0
• Bump jna.version from 5.14.0 to 5.18.1
• Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to 3.2.1
• Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to 4.5.0
• Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0 a minimum of Java 8
• Fix PMD UnnecessaryFullyQualifiedName
• Fix PMD EmptyCatchBlock by allowing commented blocks
• Fix PMD EmptyControlStatement by allowing commented blocks JasminVisitor
• SpotBugs checks should ignore code generated by JavaCC
• Fix SpotBugs URF_UNREAD_FIELD in ClassDumper
• Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor ASTFunAppl Mini.Environment
• Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC
• Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[]) TransitiveHull.getIgnored()
• Add accessors to model and unit tests, Javadoc
• Add Const.MAJOR_22
• Add Const.MINOR_22
• Add Const.MAJOR_23
• Add Const.MINOR_23
• Add Const.MAJOR_24
• Add Const.MINOR_24 2.0.0 to 4.5.0-M2
• Bump org.apache.commons:commons-parent from 69 to 71 3.1.0

• Includes changes from 6.9.0 Maintenance and bug fix release

• Add Support for Java 16 records
• Add null guard for InstructionFactory.createInvoke()
• Avoid possible NullPointerException in org.apache.bcel.classfile.DescendingVisitor.accept(E[]) AnnotationEntryGen[]) ConstantPoolGen, boolean) ElementValue[], ConstantPoolGen) org.apache.bcel.generic.ClassGen.setMethods(Method[])
• Avoid possible NullPointerException in org.apache.bcel.generic .ClassGen.unpackAnnotations(Attribute[])
• Avoid possible NullPointerException in org.apache.bcel .classfile.ParameterAnnotationEntry .createParameterAnnotationEntries(Attribute[]) org.apache.bcel.generic.ClassGen.ClassGen(JavaClass) .FieldGenOrMethodGen.addAll(Attribute[])
• Avoid NullPointerException after calling org.apache.bcel .classfile.MethodParameters.setParameters(MethodParameter[]) with null .classfile.ParameterAnnotations .setParameterAnnotationTable(ParameterAnnotationEntry[]) .classfile.LocalVariableTypeTable .setLocalVariableTable(LocalVariable[]) with null .classfile.LocalVariableTable .classfile.LineNumberTable.setLineNumberTable(LineNumber[]) .classfile.JavaClass.setMethods(Method[] with null .classfile.JavaClass.setInterfaces(int[]) with null .classfile.JavaClass.setInterfaceNames(String[]) with null .classfile.JavaClass.setFields(Field[]) with null .classfile.JavaClass.setAttributes(Attribute[]) with null .classfile.ConstantPool.setConstantPool(Constant[]) with null .classfile.FieldOrMethod.setAttributes(Attribute[]) with null .classfile.Annotations.setAnnotationTable(AnnotationEntry[]) .classfile.ArrayElementValue.ArrayElementValue(int, ElementValue[], ConstantPool) with null .classfile.BootstrapMethod.BootstrapMethod(int, int[]) with null .classfile.BootstrapMethod.setBootstrapArguments(int[]) with .classfile.BootstrapMethods.BootstrapMethods(int, int, BootstrapMethod[], ConstantPool) with null .classfile.BootstrapMethods .setBootstrapMethods(BootstrapMethod[]) with null
• Avoid NullPointerException calling org.apache.bcel.generic .InstructionList.redirectLocalVariables(LocalVariableGen[], InstructionHandle, InstructionHandle) with null .InstructionList.redirectExceptionHandlers(CodeExceptionGen[], .InstructionList.findHandle(InstructionHandle[], int[], int, int) with null .MethodGen.setArgumentTypes(Type[]) with null .MethodGen.setArgumentNames(String[]) with null .MethodGen.removeRuntimeAttributes(Attribute[]) with null .MethodGen.makeMutableVersion(AnnotationEntry[]) with null
• Bump org.apache.commons:commons-parent from 66 to 69
• Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23
• Bump commons-io:commons-io from 2.15.1 to 2.16.1

• 6.8.0 (2023-12-08) Maintenance and bug fix release ClassFormatException input Java4Example ~ Add verifier tests on some opcodes signatures ~ Add Const.MAJOR_20 ~ Add Const.MINOR_20 ~ Add Const.MAJOR_21 ~ Add Const.MINOR_21 ~ [Bcelifier] stackmap support to pass JDK verifier SE_BAD_FIELD BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH NullPointerException not a NullPointerException ~ Test and coverage of InstructionFactory ~ Verifier: test and coverage for SWAP instruction () in it`()' ~ Fix null pointers in AnnotationEntry supports package-private) test ATHROW on empty stack Select#toString(boolean) ~ Fix EmptyVisitorTestCase on Java 21 ~ Bump commons-parent from 54 to 65 ~ Bump jna.version from 5.12.1 to 5.13.0 ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21 ~ Bump commons-io from 2.11.0 to 2.15.1 ~ Bump commons-lang3 from 3.12.0 to 3.14.0 3.1.1
• 6.7.0 (2022-11-28) Maintenance and bug fix release
• 6.6.1 (2022-10-29) Maintenance and bug fix release
• 6.6.0 (2022-10-08) Minor feature and bug fix release
• 6.5.0 (2020-06-05) Minor feature and bug fix release
• 6.4.1 (2019-09-26) Bug fix release
• 6.4.0 (2019-09-20) Feature and bug fix release requires Java 7 or higher to run class org.apache.bcel.generic.InstructionConsts class java.lang.String