Apache Software Foundation Apache Commons Bcel vulnerabilities

CVE-2022-42920 [CRITICAL] CWE-787 CVE-2022-42920: Apache Commons BCEL has a number of APIs that would normally only allow changing specific class char Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the res

CVE-2026-94114 [MEDIUM] CWE-386 CVE-2026-94114: Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their s Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version

CVE-2026-105111 [MEDIUM] CWE-79 CVE-2026-105111: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). This