https://seclists.org/oss-sec/2026/q4/71: CVE-2026-94114: Apache Commons BCEL: Nested Code/cord attributes drive unbounded parse-time cursion in ClassParser

Q: Which Apache Commons BCEL versions are affected?

Apache Commons BCEL versions before 6.13.0 are affected. The issue is also fixed by commit 14890bf2b9014df25f9b4de86f29b5e917e5656b.

Q: Does exploitation require authentication or user interaction?

The CVSS vectors indicate that exploitation does not require privileges or user interaction and can be reached over a network. CVSS 3.1 rates attack complexity as high, while CVSS 4.0 identifies an additional attack requirement.

Q: What is the expected security impact?

The supplied CVSS assessments indicate an integrity impact, with no confidentiality or availability impact. The CVSS 3.1 vector rates integrity impact as high.

Q: What should organizations do if they use an affected release?

Upgrade Apache Commons BCEL to version 6.13.0. The provided advisory does not describe a workaround or configuration-based mitigation.

Published Oct 6, 2026

Updated

Affected Software

1 affected component

Apache Commons BCEL<6.13.0, <14890bf2b9014df25f9b4de86f29b5e917e5656b

Frequently Asked Questions

Which Apache Commons BCEL versions are affected?

Apache Commons BCEL versions before 6.13.0 are affected. The issue is also fixed by commit 14890bf2b9014df25f9b4de86f29b5e917e5656b.

Does exploitation require authentication or user interaction?

The CVSS vectors indicate that exploitation does not require privileges or user interaction and can be reached over a network. CVSS 3.1 rates attack complexity as high, while CVSS 4.0 identifies an additional attack requirement.

What is the expected security impact?

The supplied CVSS assessments indicate an integrity impact, with no confidentiality or availability impact. The CVSS 3.1 vector rates integrity impact as high.

What should organizations do if they use an affected release?

Upgrade Apache Commons BCEL to version 6.13.0. The provided advisory does not describe a workaround or configuration-based mitigation.

https://seclists.org/oss-sec/2026/q4/71: CVE-2026-94114: Apache Commons BCEL: Nested Code/cord attributes drive unbounded parse-time cursion in ClassParser

Affected Software

Frequently Asked Questions

Which Apache Commons BCEL versions are affected?

Does exploitation require authentication or user interaction?

What is the expected security impact?

What should organizations do if they use an affected release?

Company

Resources

Contact

Frequently Asked Questions

Which Apache Commons BCEL versions are affected?

Does exploitation require authentication or user interaction?

What is the expected security impact?

What should organizations do if they use an affected release?