Bug 2547121 (CVE-2026-94114)

Summary: CVE-2026-94114 org.apache.bcel/bcel: Apache Commons BCEL: Security verification bypass via unvalidated class caching
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bbrownin, csutherl, dsoumis, fmongiar, gmalinko, janstey, jclere, jnethert, jwon, pdelbell, pjindal, plodge, rhel-process-autobot, rmaucher, rstepani, szappis, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache Commons BCEL (Byte Code Engineering Library). When loading untrusted classes, the library caches them under their internally declared names without verifying them against the requested class name. A remote attacker could exploit this vulnerability to substitute legitimate classes with attacker-controlled ones, allowing them to bypass security verification checks and compromise application logic.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2547376, 2547377, 2547379, 2547381, 2547375, 2547378, 2547380    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-06 19:55:19 UTC 
Symbolic name not mapping to correct object vulnerability in Apache Commons.



BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.



This issue affects Apache Commons: before 6.13.0.



Users are recommended to upgrade to version 6.13.0, which fixes the issue.