Medium severity5.9NVD Advisory· Published Oct 6, 2026

CVE-2026-94114

Description

Symbolic name not mapping to correct object vulnerability in Apache Commons.

BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.

This issue affects Apache Commons: before 6.13.0.

Users are recommended to upgrade to version 6.13.0, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Commons Bcelreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <6.13.0
Apache/Apache Commonsllm-create
Range: <6.13.0

Patches

Vulnerability mechanics

References

github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patchnvd
lists.apache.org/thread.html/d87nxx7nb5bombqggxhxo9lz16nwtsf9nvd

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000