Hi,

The following vulnerability was published for bcel.

CVE-2026-94114[0]:
| Symbolic name not mapping to correct object vulnerability in Apache
| Commons.    BCEL caches attacker-controlled classes under their
| self-declared names without validating the requested name, allowing
| subsequent lookups and name-keyed verification results to refer to a
| different class.    This issue affects Apache Commons: before
| 6.13.0.    Users are recommended to upgrade to version 6.13.0, which
| fixes the issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-94114
https://www.cve.org/CVERecord?id=CVE-2026-94114
[1] https://lists.apache.org/thread/d87nxx7nb5bombqggxhxo9lz16nwtsf9

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
bcel, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150215@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated bcel package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 26 Oct 2026 09:43:26 +0100
Source: bcel
Architecture: source
Version: 6.13.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 1108557 1139087 1150215 1150227
Changes:
 bcel (6.13.0-1) unstable; urgency=medium
 .
   * New upstream release (Closes: #1108557)
     - Fixes CVE-2026-94114 and CVE-2026-105111 (Closes: #1150215, #1150227)
     - Refreshed the patches
     - New build dependency on libcommons-io-java
   * Standards-Version updated to 4.7.4
   * Removed the Priority field
   * Converted debian/watch to the version 5 format
   * Removed Torsten Werner from the Uploaders (Closes: #1139087)
Checksums-Sha1:
 9785105badb85be4c796ce08b4dcc5b36ff0e634 2181 bcel_6.13.0-1.dsc
 e57657d5de04effa428a5c7614b856adb0e1adb9 882728 bcel_6.13.0.orig.tar.xz
 5de482ceeb473734de436061a8e3ece835565fc8 7072 bcel_6.13.0-1.debian.tar.xz
 83e8fbb3b6783bd3c6c457588526db808d0b2e85 16114 bcel_6.13.0-1_source.buildinfo
Checksums-Sha256:
 f2aaa18cf01ad8115f3f53d5129600b63e03ff27f540af0d2e19e6ae9d596fae 2181 bcel_6.13.0-1.dsc
 e8d3f59bb1247ca3b164053d54488f819fc00495ecdefa0e9daf9a8af2294c8d 882728 bcel_6.13.0.orig.tar.xz
 4ecb2cc01636e2a8c37d6c7c79620812024e4571364ed2491d441d642f847d46 7072 bcel_6.13.0-1.debian.tar.xz
 9f49f97657ce549725e546946c3d14f1e2ed2019ab58e15e90ed843f8946a584 16114 bcel_6.13.0-1_source.buildinfo
Files:
 cacafe311315af97561e180bdd8c9180 2181 java optional bcel_6.13.0-1.dsc
 9396f944c823dd73d31974533324aa9d 882728 java optional bcel_6.13.0.orig.tar.xz
 4d05cb7c948cb13e350fd7d3b8fb5b9c 7072 java optional bcel_6.13.0-1.debian.tar.xz
 e8901f31351e61c760aa8eea23e844e2 16114 java optional bcel_6.13.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrfGPoSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsjP8QALBtkjncfWd05bjvwqktT0/ttDJf8fec
KToR37qsHOpL2yUNk4h2IEv2a/TMdiqNUFL+Bt84oaEaNhsIY2USdcPHAzD7qymW
C6kxw9JNQKD6N755m0pj0FLEZa4bWP5jxAHbloPtP143cm2GCgPuc125bZa7T3Te
c4LmO44lG8MiyYnMHGR9MOhLKqsWdXr1RqRKhWEwQFU6CjL7ErNjbQI4Xdiz6jl1
9AH3UBxcHkvlRPpQbP69PPjmMYIQCdmtQ6wVtqkUH8jN1Vi1ky7Okt9KjfgVLkgz
+7m5CRVknNwQ+QVRekvycqobSbasPvwV9Yr6yF/dn/cNKG9BZDq2dN1VPN7IBAr3
CUAM8MNZl3qDon4f3t3rJtNC9xrD9+SzQ88werSVTk9h9aN/deg+DW9ZLSjXjd+a
AhPczVb/gk1AOKh26WLo7zc0T979eBubxXeAS95Z9OLfFg+ZcYyTdydQKRwGNEOz
k8KORzoCB+daVh7nOsPFRDMQQLhSmc3HRBa5U6H/AVBYigGRC3eJGW7fx60SbQDs
GoVrr7jKo9aOnucf3tQwwyvyto9UijzCtl4+zZTqzdyDbQ7r4xGKj5EqqKjKmqDp
CsPJMK6c07tTZ8spNDS/iH2Pls4KpZDZPTlMdx0Bj2RsJS18TxoOd0Hf1+pdCCdV
d81JQ3Yo0XZU
=BpsH
-----END PGP SIGNATURE-----