PT-2026-107219 · Apache · Apache Commons Bcel
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Commons BCEL versions prior to 6.13.0
Description
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name. This allows subsequent lookups and name-keyed verification results to refer to a different class, leading to a symbolic name not mapping to the correct object.
Recommendations
Upgrade to version 6.13.0.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Commons Bcel