CVE-2026-94114: CWE-386 Symbolic name not mapping to correct object in Apache Software Foundation Apache Commons BCEL

Apache Commons BCEL versions prior to 6.13.0 contain a CWE-386 vulnerability where symbolic names are not properly validated when mapping to cached classes. BCEL caches classes under their self-declared names without verifying the requested symbolic name, allowing subsequent lookups and verification processes keyed by these names to reference different classes than intended. This can lead to integrity issues in name-keyed verification results. The vulnerability has a CVSS 3.1 base score of 5.9, indicating a medium severity with network attack vector, high attack complexity, no privileges required, and no user interaction needed. The issue is fixed in Apache Commons BCEL version 6.13.0.

The vulnerability allows an attacker to cause name-keyed verification results to refer to incorrect classes by exploiting the symbolic name mapping flaw. This can undermine the integrity of verification processes relying on symbolic names, potentially allowing malicious classes to be treated as legitimate. There is no direct confidentiality or availability impact reported. The attack complexity is high, and no privileges or user interaction are required.

Users should upgrade Apache Commons BCEL to version 6.13.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated.