CVE-2026-94114
published 2026-10-06CVE-2026-94114: Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name…
PriorityP333medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
EPSS
0.28%
20.2th percentile
Symbolic name not mapping to correct class.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons BCEL: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_commons_bcel | < 6.13.0 | 6.13.0 |
| apache_software_foundation | apache_commons_bcel | < 14890bf2b9014df25f9b4de86f29b5e917e5656b | 14890bf2b9014df25f9b4de86f29b5e917e5656b |
| debian | bcel | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.bcel/bcel: Apache Commons BCEL: Security verification bypass via unvalidated class caching
vendor_redhat·2026-10-06·CVSS 5.9
CVE-2026-94114 [MEDIUM] CWE-386 org.apache.bcel/bcel: Apache Commons BCEL: Security verification bypass via unvalidated class caching
org.apache.bcel/bcel: Apache Commons BCEL: Security verification bypass via unvalidated class caching
A flaw was found in Apache Commons BCEL (Byte Code Engineering Library). When loading untrusted classes, the library caches them under their internally declared names without verifying them against the requested class name. A remote attacker could exploit this vulnerability to substitute legitimate classes with attacker-controlled ones, allowing them to bypass security verification checks and compromise application logic.
Statement: This vulnerability is rated as Moderate severity because exploitation requires an application to process untrusted or maliciously crafted Java class files, and high attack complexity is needed to influence name lookups in shared class caches. In Red Hat envir
GHSA
Symbolic name not mapping to correct object vulnerability in Apache Commons.
ghsa_unreviewed·2026-10-06
CVE-2026-94114 [HIGH] CWE-386 Symbolic name not mapping to correct object vulnerability in Apache Commons.
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-94114 classloader-leak-test-framework: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-94114 [MEDIUM] CVE-2026-94114 classloader-leak-test-framework: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
CVE-2026-94114 classloader-leak-test-framework: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Bugzilla
CVE-2026-94114 rubygem-nokogiri: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-94114 [MEDIUM] CVE-2026-94114 rubygem-nokogiri: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
CVE-2026-94114 rubygem-nokogiri: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Discussion:
At least nokogiri on
Bugzilla
CVE-2026-94114 fpc: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-94114 [MEDIUM] CVE-2026-94114 fpc: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
CVE-2026-94114 fpc: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Discussion:
As explained in rhbz#2547330, fpc
Bugzilla
CVE-2026-94114 rubygem-nokogiri: Apache Commons BCEL: Security verification bypass via unvalidated class caching [epel-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-94114 [MEDIUM] CVE-2026-94114 rubygem-nokogiri: Apache Commons BCEL: Security verification bypass via unvalidated class caching [epel-all]
CVE-2026-94114 rubygem-nokogiri: Apache Commons BCEL: Security verification bypass via unvalidated class caching [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Bugzilla
CVE-2026-94114 tomcat-jakartaee-migration: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-94114 [MEDIUM] CVE-2026-94114 tomcat-jakartaee-migration: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
CVE-2026-94114 tomcat-jakartaee-migration: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Bugzilla
CVE-2026-94114 fpc: Apache Commons BCEL: Security verification bypass via unvalidated class caching [epel-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-94114 [MEDIUM] CVE-2026-94114 fpc: Apache Commons BCEL: Security verification bypass via unvalidated class caching [epel-all]
CVE-2026-94114 fpc: Apache Commons BCEL: Security verification bypass via unvalidated class caching [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Discussion:
As explained in rhbz#2547332, fpc i
Bugzilla
CVE-2026-94114 maven-native: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-94114 [MEDIUM] CVE-2026-94114 maven-native: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
CVE-2026-94114 maven-native: Apache Commons BCEL: Security verification bypass via unvalidated class caching [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Bugzilla
CVE-2026-94114 org.apache.bcel/bcel: Apache Commons BCEL: Security verification bypass via unvalidated class caching
bugzilla·2026-10-06·CVSS 5.9
CVE-2026-94114 [MEDIUM] CVE-2026-94114 org.apache.bcel/bcel: Apache Commons BCEL: Security verification bypass via unvalidated class caching
CVE-2026-94114 org.apache.bcel/bcel: Apache Commons BCEL: Security verification bypass via unvalidated class caching
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
2026-10-06
Published