CVE-2026-94114

A flaw was found in Apache Commons BCEL (Byte Code Engineering Library). When loading untrusted classes, the library caches them under their internally declared names without verifying them against the requested class name. A remote attacker could exploit this vulnerability to substitute legitimate classes with attacker-controlled ones, allowing them to bypass security verification checks and compromise application logic.

This vulnerability is rated as Moderate severity because exploitation requires an application to process untrusted or maliciously crafted Java class files, and high attack complexity is needed to influence name lookups in shared class caches. In Red Hat environments, Apache Commons BCEL is primarily used in migration utilities and build tooling rather than in continuously exposed network services processing arbitrary bytecode. Consequently, typical production deployments do not expose the affected class caching mechanism to untrusted input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.