Apache Commons BCEL: Class name mismatch leads to class cache poisoning
Summary
Apache Commons BCEL, a Java library for reading and manipulating class files, caches classes under the class name declared inside the file rather than the name requested. An attacker who can supply class files to an application using BCEL may cause later lookups to return a different class. The official CVE record describes this as a class cache poisoning issue. The sources conflict on the exact scope of this CVE ID, so the description should be verified with Apache or NVD.
Affected
- Apache Commons BCEL before 6.13.0
- Apache Commons BCEL before commit 14890bf2b9014df25f9b4de86f29b5e917e5656b
Fixed in
- Apache Commons BCEL 6.13.0 (fix commit 14890bf2b9014df25f9b4de86f29b5e917e5656b)
- Distribution fixed versions: Unknown.
Workaround
- No vendor-issued workaround known.
- Ensure the application does not load untrusted class files through BCEL.
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
Our recommendation
- Inventory Java applications and dependency trees for bcel (for example with mvn dependency:tree).
- Update Apache Commons BCEL to 6.13.0 or later, and check vendor packages you use.
- Prioritise Java applications that load externally supplied class files or bytecode.
- Verify the scope of CVE-2026-94114 with Apache or NVD, as the sources conflict.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Commons BCEL commit 14890bf (patch) github.com
- OSV: CVE-2026-94114 osv.dev
- Apache Commons BCEL changes commons.apache.org
- Apache announcement (mail-archive) www.mail-archive.com
- oss-security posting 2026/10/07 www.openwall.com
- SUSE CVE tracker vulners.com
- Debian CVE tracker vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:56.
Original description (NVD)
Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.