OPENSUSE-SU-2026:22109-1

Vulnerability from csaf_opensuse - Published: 2026-10-16 12:21 - Updated: 2026-10-19 17:25
Summary
Security update for bcel
Severity
Moderate
Notes
Title of the patch: Security update for bcel
Description of the patch: This update for bcel fixes the following issues: - CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400). - CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399). Changes for bcel: - Update to version 6.13.0 * New Features + Add support for permitted subclasses + Add RecordComponentInfo.getAttribute(byte tag) + Add Const.MAJOR_27 + Add Const.MINOR_27 + Add and use ArrayType.isElementType(Type) + Add Const.MAJOR_28 + Add Const.MINOR_28 * Fixed Bugs + Fix constant pool module access test on Java 26 and above + Deprecate org.apache.bcel.classfile.Utility.Utility() + Deprecate org.apache.bcel.verifier.exc.Utility .getStackTrace(Throwable) + Fix all Javadoc warnings and enforce checks by default + Escape constant pool names in generated HTML + Escape referenced names in BCELFactory Java output + Make wide flag thread-local in Utility.codeToString + Read multianewarray dimensions as unsigned byte + Site docs: clarify security model + Read ConstantDynamic indices as unsigned shorts + Validate index upper bound in CPInstruction, IINC and RET setIndex + Use correct attribute tag in NestHost and ModuleMainClass + Propagate runtime-visible flag when parsing parameter annotations + Use fixedLength for parsed LOOKUPSWITCH length + Fix ConstantPoolGen dedup key collisions for names with delimiters + Read unsigned bytecode operands in CodeHTML disassembler + Deep-copy bootstrap arguments array in BootstrapMethod.copy() + Use exclusive live-range end in LocalVariableTable .getLocalVariable + Build TABLESWITCH from sorted arrays in SWITCH + Use array element type not basic type for primitive array access + Set length in INVOKEDYNAMIC constructor + Reject CALOAD on non-char arrays in structural verification + Add negative verifier tests for remaining array load/store component type checks + Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY + Match wide local variable instruction length to dumped bytes + Bound IINC increment to signed short + Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8 + Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser + Nested annotation element values recurse unboundedly; MAX_ARRAY_DIMENSIONS cap bypassed + Opcodes tableswitch and lookupswitch add boundary checks + JustIce Pass 2 hangs on cyclic superclass chain of a referenced exception class + JustIce Pass 2 LVT check amplifies each 10-byte entry into ~131k hashtable operations + Pass 3b dataflow stores frames per instruction and clones ever-growing execution chains + Cubic handlers * range * subroutines scan in Subroutines constructor hangs JustIce Pass 3b + Subroutines.noRecursiveCalls enumerates exponentially many JSR call paths + Disassembler and Class2HTML re-implement the unchecked switch-table allocation + ConstantPool.constantToString recurses forever on self-referencing CONSTANT_MethodHandle + Utility.typeSignatureToString recurses per generic-nesting level, unbounded, with quadratic substring copies + Repositories cache classes under the input-defined this_class name; global static Repository/VerifierFactory make the poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114) + Silent u2/u1 count truncation across dump paths corrupts emitted bytecode + Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports) (bsc#1284399, CVE-2026-105111) + Class2HTML builds output file paths from the unvalidated class name + ClassPath.getBytes() sizes its buffer from the forged ZIP uncompressed-size field + PMG attribute ignores declared length, enabling BCEL-vs-JVM parse divergence + Signature.matchGJIdent recurses unboundedly on nested generic signatures (Signature.translate) + Utility.decode fixed 3x buffer breaks the encode/decode round trip and throws unchecked AIOOBE + BCELifier interpolates attacker class/package names into generated Java source unescaped + Verifier pass 3a delayed checks are quadratic in attribute and code size + Verifier cache grows unboundedly with attacker-chosen class names + Static WIDE ThreadLocal survives exceptions, corrupting the next class's disassembly on the same thread + Utility.JavaReader escape decoding: OOB table index, bad-hex crash, silent non-canonical aliasing * Changes + Bump org.apache.commons:commons-parent from 95 to 104 + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20 + Bump commons-io:commons-io from 2.21.0 to 2.22.0 + Bump jna.version from 5.18.1 to 5.19.1 + [test] Bump org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0 - Changes of version 6.12.0 + Add Const.MAJOR_26 + Add Const.MINOR_26 + Fix infinite loop in example.TransitiveHull + Fix Apache RAT plugin console warnings + Fix malformed Javadoc comments + Make the build reproducible on the Azul JDK + Fix infinite loop in JavaClass.findField() on invalid input + Fix infinite loop in JavaClass.getAllInterfaces() on invalid input + Fix infinite loop in JavaClass.getSuperClasses() on invalid + Exception message in Args.requireU4() refers to the wrong data type + Exception message in Args.requireU2() refers to the wrong upper range value + Code.Code(int, int, DataInput, ConstantPool) now throws a ClassFormatException if the code array is greater than the JVM specification allows + Code.Code(int, int, int, int, byte[], CodeException[], Attribute[], ConstantPool) now throws a ClassFormatException if the code array is greater than the JVM specification allows + Code.setCode(byte[]) now throws a ClassFormatException if the code array is greater than the JVM specification allows + ClassDumper.dump() should not call the input stream it didn't open; fixes IOException when calling DumpClass.main (ClassDumper.java:351) + org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[]) now uses varagrs: ConstantPool(Constant...) + org.apache.bcel.classfile.Deprecated now requires its the attribute_length item be zero + org.apache.bcel.classfile.Synthetic now requires its the + The size of an Attribute unknown to the JVM specification is limited to 1 MB and is overridden with the system property BCEL.Attribute.Unknown.max_attribute_length + Bump org.apache.commons:commons-parent from 89 to 95 + [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to 2.3.0 + Bump commons-io:commons-io from 2.20.0 to 2.21.0 + Bump commons-lang3 from 3.19.0 to 3.20.0 + [test] Bump org.apache.commons:commons-exec from 1.5.0 to 1.6.0 - Changes of version 6.11.0 + Add Const.MAJOR_25 + Add Const.MINOR_25 + Add experimental CycloneDX VEX file + Refactor to use new Maven POM variable ecj.version + Replace internal use of Locale.ENGLISH with Locale.ROOT + BCEL-375: Wrong permissions on bcel .jar file in binary .tar.gz distribution file + BCEL-376: ClassPath.close() throws UnsupportedOperationException when created with system-classpath + ClassPath.getResources(String) can use an ArrayList instead of a Vector + Fix SpotBugs [ERROR] Medium: Operation on the "created" shared variable in "ConstantUtf8" class is not atomic [org.apache .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE + Fix SpotBugs [ERROR] Medium: Operation on the "considered" shared variable in "ConstantUtf8" class is not atomic [org .apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java: [line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE + Fix SpotBugs [ERROR] Medium: Operation on the "skipped" shared .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134] + org.apache.bcel.util.ClassPath .addJdkModules(String, List<String>) now reads the system property "jdk.module.path" instead of "java.modules.path" + Fix ConstantPoolModuleAccessTest failures on Java 25 + 377: Fix testing on Java 24 and up + Bump org.apache.commons:commons-parent from 72 to 89 + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0 + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20 + Bump commons-io:commons-io from 2.16.1 to 2.20.0 + Bump jna.version from 5.14.0 to 5.18.1 + Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to 3.2.1 + Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to 4.5.0 + Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0 a minimum of Java 8 + Fix PMD UnnecessaryFullyQualifiedName + Fix PMD EmptyCatchBlock by allowing commented blocks + Fix PMD EmptyControlStatement by allowing commented blocks JasminVisitor + SpotBugs checks should ignore code generated by JavaCC + Fix SpotBugs URF_UNREAD_FIELD in ClassDumper + Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor ASTFunAppl Mini.Environment + Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC + Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[]) TransitiveHull.getIgnored() + Add accessors to model and unit tests, Javadoc + Add Const.MAJOR_22 + Add Const.MINOR_22 + Add Const.MAJOR_23 + Add Const.MINOR_23 + Add Const.MAJOR_24 + Add Const.MINOR_24 2.0.0 to 4.5.0-M2 + Bump org.apache.commons:commons-parent from 69 to 71 3.1.0 * Includes changes from 6.9.0 Maintenance and bug fix release + Add Support for Java 16 records + Add null guard for InstructionFactory.createInvoke() + Avoid possible NullPointerException in org.apache.bcel.classfile.DescendingVisitor.accept(E[]) AnnotationEntryGen[]) ConstantPoolGen, boolean) ElementValue[], ConstantPoolGen) org.apache.bcel.generic.ClassGen.setMethods(Method[]) + Avoid possible NullPointerException in org.apache.bcel.generic .ClassGen.unpackAnnotations(Attribute[]) + Avoid possible NullPointerException in org.apache.bcel .classfile.ParameterAnnotationEntry .createParameterAnnotationEntries(Attribute[]) org.apache.bcel.generic.ClassGen.ClassGen(JavaClass) .FieldGenOrMethodGen.addAll(Attribute[]) + Avoid NullPointerException after calling org.apache.bcel .classfile.MethodParameters.setParameters(MethodParameter[]) with null .classfile.ParameterAnnotations .setParameterAnnotationTable(ParameterAnnotationEntry[]) .classfile.LocalVariableTypeTable .setLocalVariableTable(LocalVariable[]) with null .classfile.LocalVariableTable .classfile.LineNumberTable.setLineNumberTable(LineNumber[]) .classfile.JavaClass.setMethods(Method[] with null .classfile.JavaClass.setInterfaces(int[]) with null .classfile.JavaClass.setInterfaceNames(String[]) with null .classfile.JavaClass.setFields(Field[]) with null .classfile.JavaClass.setAttributes(Attribute[]) with null .classfile.ConstantPool.setConstantPool(Constant[]) with null .classfile.FieldOrMethod.setAttributes(Attribute[]) with null .classfile.Annotations.setAnnotationTable(AnnotationEntry[]) .classfile.ArrayElementValue.ArrayElementValue(int, ElementValue[], ConstantPool) with null .classfile.BootstrapMethod.BootstrapMethod(int, int[]) with null .classfile.BootstrapMethod.setBootstrapArguments(int[]) with .classfile.BootstrapMethods.BootstrapMethods(int, int, BootstrapMethod[], ConstantPool) with null .classfile.BootstrapMethods .setBootstrapMethods(BootstrapMethod[]) with null + Avoid NullPointerException calling org.apache.bcel.generic .InstructionList.redirectLocalVariables(LocalVariableGen[], InstructionHandle, InstructionHandle) with null .InstructionList.redirectExceptionHandlers(CodeExceptionGen[], .InstructionList.findHandle(InstructionHandle[], int[], int, int) with null .MethodGen.setArgumentTypes(Type[]) with null .MethodGen.setArgumentNames(String[]) with null .MethodGen.removeRuntimeAttributes(Attribute[]) with null .MethodGen.makeMutableVersion(AnnotationEntry[]) with null + Bump org.apache.commons:commons-parent from 66 to 69 + Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23 + Bump commons-io:commons-io from 2.15.1 to 2.16.1 * 6.8.0 (2023-12-08) Maintenance and bug fix release ClassFormatException input Java4Example ~ Add verifier tests on some opcodes signatures ~ Add Const.MAJOR_20 ~ Add Const.MINOR_20 ~ Add Const.MAJOR_21 ~ Add Const.MINOR_21 ~ [Bcelifier] stackmap support to pass JDK verifier SE_BAD_FIELD BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH NullPointerException not a NullPointerException ~ Test and coverage of InstructionFactory ~ Verifier: test and coverage for SWAP instruction () in it`()' ~ Fix null pointers in AnnotationEntry supports package-private) test ATHROW on empty stack Select#toString(boolean) ~ Fix EmptyVisitorTestCase on Java 21 ~ Bump commons-parent from 54 to 65 ~ Bump jna.version from 5.12.1 to 5.13.0 ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21 ~ Bump commons-io from 2.11.0 to 2.15.1 ~ Bump commons-lang3 from 3.12.0 to 3.14.0 3.1.1 * 6.7.0 (2022-11-28) Maintenance and bug fix release * 6.6.1 (2022-10-29) Maintenance and bug fix release * 6.6.0 (2022-10-08) Minor feature and bug fix release * 6.5.0 (2020-06-05) Minor feature and bug fix release * 6.4.1 (2019-09-26) Bug fix release * 6.4.0 (2019-09-20) Feature and bug fix release requires Java 7 or higher to run class org.apache.bcel.generic.InstructionConsts class java.lang.String
Patchnames: openSUSE-Leap-16.0-1923
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-105111
4.7 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:bcel-0:6.13.0-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:bcel-javadoc-0:6.13.0-160000.1.1.noarch —
Vendor Fix
Threats
Impact moderate
CVE-2026-94114
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 2 products, the same list as for CVE-2026-105111
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for bcel",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for bcel fixes the following issues:\n\n- CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400).\n- CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399).\n\nChanges for bcel:\n\n- Update to version 6.13.0\n * New Features\n + Add support for permitted subclasses\n + Add RecordComponentInfo.getAttribute(byte tag)\n + Add Const.MAJOR_27\n + Add Const.MINOR_27\n + Add and use ArrayType.isElementType(Type)\n + Add Const.MAJOR_28\n + Add Const.MINOR_28\n * Fixed Bugs\n + Fix constant pool module access test on Java 26 and above\n + Deprecate org.apache.bcel.classfile.Utility.Utility()\n + Deprecate org.apache.bcel.verifier.exc.Utility\n .getStackTrace(Throwable)\n + Fix all Javadoc warnings and enforce checks by default\n + Escape constant pool names in generated HTML\n + Escape referenced names in BCELFactory Java output\n + Make wide flag thread-local in Utility.codeToString\n + Read multianewarray dimensions as unsigned byte\n + Site docs: clarify security model\n + Read ConstantDynamic indices as unsigned shorts\n + Validate index upper bound in CPInstruction, IINC and RET\n setIndex\n + Use correct attribute tag in NestHost and ModuleMainClass\n + Propagate runtime-visible flag when parsing parameter\n annotations\n + Use fixedLength for parsed LOOKUPSWITCH length\n + Fix ConstantPoolGen dedup key collisions for names with\n delimiters\n + Read unsigned bytecode operands in CodeHTML disassembler\n + Deep-copy bootstrap arguments array in BootstrapMethod.copy()\n + Use exclusive live-range end in LocalVariableTable\n .getLocalVariable\n + Build TABLESWITCH from sorted arrays in SWITCH\n + Use array element type not basic type for primitive array\n access\n + Set length in INVOKEDYNAMIC constructor\n + Reject CALOAD on non-char arrays in structural verification\n + Add negative verifier tests for remaining array load/store\n component type checks\n + Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY\n + Match wide local variable instruction length to dumped bytes\n + Bound IINC increment to signed short\n + Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8\n + Nested Code/Record attributes drive unbounded parse-time\n recursion in ClassParser\n + Nested annotation element values recurse unboundedly;\n MAX_ARRAY_DIMENSIONS cap bypassed\n + Opcodes tableswitch and lookupswitch add boundary checks\n + JustIce Pass 2 hangs on cyclic superclass chain of a\n referenced exception class\n + JustIce Pass 2 LVT check amplifies each 10-byte entry into\n ~131k hashtable operations\n + Pass 3b dataflow stores frames per instruction and clones\n ever-growing execution chains\n + Cubic handlers * range * subroutines scan in Subroutines\n constructor hangs JustIce Pass 3b\n + Subroutines.noRecursiveCalls enumerates exponentially many JSR\n call paths\n + Disassembler and Class2HTML re-implement the unchecked\n switch-table allocation\n + ConstantPool.constantToString recurses forever on\n self-referencing CONSTANT_MethodHandle\n + Utility.typeSignatureToString recurses per generic-nesting\n level, unbounded, with quadratic substring copies\n + Repositories cache classes under the input-defined this_class\n name; global static Repository/VerifierFactory make the\n poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114)\n + Silent u2/u1 count truncation across dump paths corrupts\n emitted bytecode\n + Class2HTML emitters write attacker class-file strings into\n HTML unescaped (stored XSS in reports) (bsc#1284399,\n CVE-2026-105111)\n + Class2HTML builds output file paths from the unvalidated class\n name\n + ClassPath.getBytes() sizes its buffer from the forged ZIP\n uncompressed-size field\n + PMG attribute ignores declared length, enabling BCEL-vs-JVM\n parse divergence\n + Signature.matchGJIdent recurses unboundedly on nested generic\n signatures (Signature.translate)\n + Utility.decode fixed 3x buffer breaks the encode/decode round\n trip and throws unchecked AIOOBE\n + BCELifier interpolates attacker class/package names into\n generated Java source unescaped\n + Verifier pass 3a delayed checks are quadratic in attribute and\n code size\n + Verifier cache grows unboundedly with attacker-chosen class\n names\n + Static WIDE ThreadLocal survives exceptions, corrupting the\n next class\u0027s disassembly on the same thread\n + Utility.JavaReader escape decoding: OOB table index, bad-hex\n crash, silent non-canonical aliasing\n * Changes\n + Bump org.apache.commons:commons-parent from 95 to 104\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20\n + Bump commons-io:commons-io from 2.21.0 to 2.22.0\n + Bump jna.version from 5.18.1 to 5.19.1\n + [test] Bump org.apache.commons:commons-collections4 from 4.5.0\n to 4.6.0\n- Changes of version 6.12.0\n + Add Const.MAJOR_26\n + Add Const.MINOR_26\n + Fix infinite loop in example.TransitiveHull\n + Fix Apache RAT plugin console warnings\n + Fix malformed Javadoc comments\n + Make the build reproducible on the Azul JDK\n + Fix infinite loop in JavaClass.findField() on invalid input\n + Fix infinite loop in JavaClass.getAllInterfaces() on invalid\n input\n + Fix infinite loop in JavaClass.getSuperClasses() on invalid\n + Exception message in Args.requireU4() refers to the wrong data\n type\n + Exception message in Args.requireU2() refers to the wrong\n upper range value\n + Code.Code(int, int, DataInput, ConstantPool) now throws a\n ClassFormatException if the code array is greater than the\n JVM specification allows\n + Code.Code(int, int, int, int, byte[], CodeException[],\n Attribute[], ConstantPool) now throws a ClassFormatException\n if the code array is greater than the JVM specification allows\n + Code.setCode(byte[]) now throws a ClassFormatException if the\n code array is greater than the JVM specification allows\n + ClassDumper.dump() should not call the input stream it didn\u0027t\n open; fixes IOException when calling DumpClass.main\n (ClassDumper.java:351)\n + org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[])\n now uses varagrs: ConstantPool(Constant...)\n + org.apache.bcel.classfile.Deprecated now requires its the\n attribute_length item be zero\n + org.apache.bcel.classfile.Synthetic now requires its the\n + The size of an Attribute unknown to the JVM specification is\n limited to 1 MB and is overridden with the system property\n BCEL.Attribute.Unknown.max_attribute_length\n + Bump org.apache.commons:commons-parent from 89 to 95\n + [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to\n 2.3.0\n + Bump commons-io:commons-io from 2.20.0 to 2.21.0\n + Bump commons-lang3 from 3.19.0 to 3.20.0\n + [test] Bump org.apache.commons:commons-exec from 1.5.0 to\n 1.6.0\n- Changes of version 6.11.0\n + Add Const.MAJOR_25\n + Add Const.MINOR_25\n + Add experimental CycloneDX VEX file\n + Refactor to use new Maven POM variable ecj.version\n + Replace internal use of Locale.ENGLISH with Locale.ROOT\n + BCEL-375: Wrong permissions on bcel .jar file in binary\n .tar.gz distribution file\n + BCEL-376: ClassPath.close() throws\n UnsupportedOperationException when created with\n system-classpath\n + ClassPath.getResources(String) can use an ArrayList instead of\n a Vector\n + Fix SpotBugs [ERROR] Medium: Operation on the \"created\" shared\n variable in \"ConstantUtf8\" class is not atomic [org.apache\n .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119]\n AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE\n + Fix SpotBugs [ERROR] Medium: Operation on the \"considered\"\n shared variable in \"ConstantUtf8\" class is not atomic [org\n .apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:\n [line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE\n + Fix SpotBugs [ERROR] Medium: Operation on the \"skipped\" shared\n .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134]\n + org.apache.bcel.util.ClassPath\n .addJdkModules(String, List\u003cString\u003e) now reads the system\n property \"jdk.module.path\" instead of \"java.modules.path\"\n + Fix ConstantPoolModuleAccessTest failures on Java 25\n + 377: Fix testing on Java 24 and up\n + Bump org.apache.commons:commons-parent from 72 to 89\n + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20\n + Bump commons-io:commons-io from 2.16.1 to 2.20.0\n + Bump jna.version from 5.14.0 to 5.18.1\n + Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to\n 3.2.1\n + Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to\n 4.5.0\n + Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0\n a minimum of Java 8\n + Fix PMD UnnecessaryFullyQualifiedName\n + Fix PMD EmptyCatchBlock by allowing commented blocks\n + Fix PMD EmptyControlStatement by allowing commented blocks\n JasminVisitor\n + SpotBugs checks should ignore code generated by JavaCC\n + Fix SpotBugs URF_UNREAD_FIELD in ClassDumper\n + Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor\n ASTFunAppl\n Mini.Environment\n + Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC\n + Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[])\n TransitiveHull.getIgnored()\n + Add accessors to model and unit tests, Javadoc\n + Add Const.MAJOR_22\n + Add Const.MINOR_22\n + Add Const.MAJOR_23\n + Add Const.MINOR_23\n + Add Const.MAJOR_24\n + Add Const.MINOR_24\n 2.0.0\n to 4.5.0-M2\n + Bump org.apache.commons:commons-parent from 69 to 71\n 3.1.0\n * Includes changes from 6.9.0 Maintenance and bug fix release\n + Add Support for Java 16 records\n + Add null guard for InstructionFactory.createInvoke()\n + Avoid possible NullPointerException in\n org.apache.bcel.classfile.DescendingVisitor.accept(E[])\n AnnotationEntryGen[])\n ConstantPoolGen, boolean)\n ElementValue[], ConstantPoolGen)\n org.apache.bcel.generic.ClassGen.setMethods(Method[])\n + Avoid possible NullPointerException in org.apache.bcel.generic\n .ClassGen.unpackAnnotations(Attribute[])\n + Avoid possible NullPointerException in org.apache.bcel\n .classfile.ParameterAnnotationEntry\n .createParameterAnnotationEntries(Attribute[])\n org.apache.bcel.generic.ClassGen.ClassGen(JavaClass)\n .FieldGenOrMethodGen.addAll(Attribute[])\n + Avoid NullPointerException after calling org.apache.bcel\n .classfile.MethodParameters.setParameters(MethodParameter[])\n with null\n .classfile.ParameterAnnotations\n .setParameterAnnotationTable(ParameterAnnotationEntry[])\n .classfile.LocalVariableTypeTable\n .setLocalVariableTable(LocalVariable[]) with null\n .classfile.LocalVariableTable\n .classfile.LineNumberTable.setLineNumberTable(LineNumber[])\n .classfile.JavaClass.setMethods(Method[] with null\n .classfile.JavaClass.setInterfaces(int[]) with null\n .classfile.JavaClass.setInterfaceNames(String[]) with null\n .classfile.JavaClass.setFields(Field[]) with null\n .classfile.JavaClass.setAttributes(Attribute[]) with null\n .classfile.ConstantPool.setConstantPool(Constant[]) with null\n .classfile.FieldOrMethod.setAttributes(Attribute[]) with null\n .classfile.Annotations.setAnnotationTable(AnnotationEntry[])\n .classfile.ArrayElementValue.ArrayElementValue(int,\n ElementValue[], ConstantPool) with null\n .classfile.BootstrapMethod.BootstrapMethod(int, int[]) with\n null\n .classfile.BootstrapMethod.setBootstrapArguments(int[]) with\n .classfile.BootstrapMethods.BootstrapMethods(int, int,\n BootstrapMethod[], ConstantPool) with null\n .classfile.BootstrapMethods\n .setBootstrapMethods(BootstrapMethod[]) with null\n + Avoid NullPointerException calling org.apache.bcel.generic\n .InstructionList.redirectLocalVariables(LocalVariableGen[],\n InstructionHandle, InstructionHandle) with null\n .InstructionList.redirectExceptionHandlers(CodeExceptionGen[],\n .InstructionList.findHandle(InstructionHandle[], int[], int,\n int) with null\n .MethodGen.setArgumentTypes(Type[]) with null\n .MethodGen.setArgumentNames(String[]) with null\n .MethodGen.removeRuntimeAttributes(Attribute[]) with null\n .MethodGen.makeMutableVersion(AnnotationEntry[]) with null\n + Bump org.apache.commons:commons-parent from 66 to 69\n + Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23\n + Bump commons-io:commons-io from 2.15.1 to 2.16.1\n * 6.8.0 (2023-12-08) Maintenance and bug fix release\n ClassFormatException\n input Java4Example\n ~ Add verifier tests on some opcodes\n signatures\n ~ Add Const.MAJOR_20\n ~ Add Const.MINOR_20\n ~ Add Const.MAJOR_21\n ~ Add Const.MINOR_21\n ~ [Bcelifier] stackmap support to pass JDK verifier\n SE_BAD_FIELD\n BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH\n NullPointerException\n not a NullPointerException\n ~ Test and coverage of InstructionFactory\n ~ Verifier: test and coverage for SWAP instruction\n () in it`()\u0027\n ~ Fix null pointers in AnnotationEntry\n supports package-private)\n test\n ATHROW on empty stack\n Select#toString(boolean)\n ~ Fix EmptyVisitorTestCase on Java 21\n ~ Bump commons-parent from 54 to 65\n ~ Bump jna.version from 5.12.1 to 5.13.0\n ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21\n ~ Bump commons-io from 2.11.0 to 2.15.1\n ~ Bump commons-lang3 from 3.12.0 to 3.14.0\n 3.1.1\n * 6.7.0 (2022-11-28) Maintenance and bug fix release\n * 6.6.1 (2022-10-29) Maintenance and bug fix release\n * 6.6.0 (2022-10-08) Minor feature and bug fix release\n * 6.5.0 (2020-06-05) Minor feature and bug fix release\n * 6.4.1 (2019-09-26) Bug fix release\n * 6.4.0 (2019-09-20) Feature and bug fix release\n requires Java 7 or higher to run\n class\n org.apache.bcel.generic.InstructionConsts class\n java.lang.String\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1923",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_22109-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1284399",
        "url": "https://bugzilla.suse.com/1284399"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1284400",
        "url": "https://bugzilla.suse.com/1284400"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-105111 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-105111/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-94114 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-94114/"
      }
    ],
    "title": "Security update for bcel",
    "tracking": {
      "current_release_date": "2026-10-19T17:25:32Z",
      "generator": {
        "date": "2026-10-16T12:21:25Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:22109-1",
      "initial_release_date": "2026-10-16T12:21:25Z",
      "revision_history": [
        {
          "date": "2026-10-16T12:21:25Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-19T17:25:32Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bcel-0:6.13.0-160000.1.1.noarch",
                "product": {
                  "name": "bcel-0:6.13.0-160000.1.1.noarch",
                  "product_id": "bcel-0:6.13.0-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:commons_bcel:6.13.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bcel@6.13.0-160000.1.1?arch=noarch\u0026upstream=bcel-0:6.13.0-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bcel-javadoc-0:6.13.0-160000.1.1.noarch",
                "product": {
                  "name": "bcel-javadoc-0:6.13.0-160000.1.1.noarch",
                  "product_id": "bcel-javadoc-0:6.13.0-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:commons_bcel:6.13.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bcel-javadoc@6.13.0-160000.1.1?arch=noarch\u0026upstream=bcel-0:6.13.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bcel-0:6.13.0-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:bcel-0:6.13.0-160000.1.1.noarch"
        },
        "product_reference": "bcel-0:6.13.0-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bcel-javadoc-0:6.13.0-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:bcel-javadoc-0:6.13.0-160000.1.1.noarch"
        },
        "product_reference": "bcel-javadoc-0:6.13.0-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-105111",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-105111"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Commons BCEL.\n\n\n\nThis only happens when you\u0027re using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:bcel-0:6.13.0-160000.1.1.noarch",
          "openSUSE Leap 16.0:bcel-javadoc-0:6.13.0-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-105111",
          "url": "https://www.suse.com/security/cve/CVE-2026-105111"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284399 for CVE-2026-105111",
          "url": "https://bugzilla.suse.com/1284399"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:bcel-0:6.13.0-160000.1.1.noarch",
            "openSUSE Leap 16.0:bcel-javadoc-0:6.13.0-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:bcel-0:6.13.0-160000.1.1.noarch",
            "openSUSE Leap 16.0:bcel-javadoc-0:6.13.0-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-16T12:21:25Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-105111"
    },
    {
      "cve": "CVE-2026-94114",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-94114"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Symbolic name not mapping to correct class.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:bcel-0:6.13.0-160000.1.1.noarch",
          "openSUSE Leap 16.0:bcel-javadoc-0:6.13.0-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-94114",
          "url": "https://www.suse.com/security/cve/CVE-2026-94114"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284400 for CVE-2026-94114",
          "url": "https://bugzilla.suse.com/1284400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:bcel-0:6.13.0-160000.1.1.noarch",
            "openSUSE Leap 16.0:bcel-javadoc-0:6.13.0-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:bcel-0:6.13.0-160000.1.1.noarch",
            "openSUSE Leap 16.0:bcel-javadoc-0:6.13.0-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-16T12:21:25Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-94114"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.