As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser
Apache Commons BCEL before version 6.13.0 contains a vulnerability in its ClassParser that allows unbounded parse-time recursion through nested code and record attributes. An attacker can exploit this by providing specially crafted class files that trigger excessive recursion during parsing.
Why it matters: Developers using Apache Commons BCEL in applications that parse untrusted or user-supplied Java class files face a denial of service risk and potential code integrity issues; update to version 6.13.0 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser
Apache Commons BCEL before version 6.13.0 contains a vulnerability where nested code and record attributes in ClassParser can trigger unbounded parse-time recursion. The flaw allows attackers to cause integrity issues through specially crafted class files.
Why it matters: Developers and security teams using Apache Commons BCEL in production systems should update to version 6.13.0 or later, as CVE-2026-94114 with CVSS 8.2 can be exploited over the network to corrupt data integrity.
- Source published
- First seen by Cybersecurity Tracker