SUSE-SU-2026:24258-1: moderate: Security update for bcel
SLE-SECURITY-UPDATES
null at suse.de
Thu Oct 22 20:32:22 UTC 2026
# Security update for bcel
Announcement ID: SUSE-SU-2026:24258-1
Release Date: 2026-10-16T12:21:02Z
Rating: moderate
References:
* bsc#1284399
* bsc#1284400
Cross-References:
* CVE-2026-105111
* CVE-2026-94114
CVSS scores:
* CVE-2026-105111 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-105111 ( NVD ): 2.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-105111 ( NVD ): 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-94114 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-94114 ( NVD ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-94114 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products:
* SUSE Linux Enterprise Server 16.0
* SUSE Linux Enterprise Server for SAP applications 16.0
An update that solves two vulnerabilities can now be installed.
## Description:
This update for bcel fixes the following issues:
* CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time
recursion in ClassParser (bsc#1284400).
* CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored
XSS (bsc#1284399).
Changes for bcel:
* Update to version 6.13.0
* New Features
* Add support for permitted subclasses
* Add RecordComponentInfo.getAttribute(byte tag)
* Add Const.MAJOR_27
* Add Const.MINOR_27
* Add and use ArrayType.isElementType(Type)
* Add Const.MAJOR_28
* Add Const.MINOR_28
* Fixed Bugs
* Fix constant pool module access test on Java 26 and above
* Deprecate org.apache.bcel.classfile.Utility.Utility()
* Deprecate org.apache.bcel.verifier.exc.Utility .getStackTrace(Throwable)
* Fix all Javadoc warnings and enforce checks by default
* Escape constant pool names in generated HTML
* Escape referenced names in BCELFactory Java output
* Make wide flag thread-local in Utility.codeToString
* Read multianewarray dimensions as unsigned byte
* Site docs: clarify security model
* Read ConstantDynamic indices as unsigned shorts
* Validate index upper bound in CPInstruction, IINC and RET setIndex
* Use correct attribute tag in NestHost and ModuleMainClass
* Propagate runtime-visible flag when parsing parameter annotations
* Use fixedLength for parsed LOOKUPSWITCH length
* Fix ConstantPoolGen dedup key collisions for names with delimiters
* Read unsigned bytecode operands in CodeHTML disassembler
* Deep-copy bootstrap arguments array in BootstrapMethod.copy()
* Use exclusive live-range end in LocalVariableTable .getLocalVariable
* Build TABLESWITCH from sorted arrays in SWITCH
* Use array element type not basic type for primitive array access
* Set length in INVOKEDYNAMIC constructor
* Reject CALOAD on non-char arrays in structural verification
* Add negative verifier tests for remaining array load/store component type
checks
* Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY
* Match wide local variable instruction length to dumped bytes
* Bound IINC increment to signed short
* Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8
* Nested Code/Record attributes drive unbounded parse-time recursion in
ClassParser
* Nested annotation element values recurse unboundedly; MAX_ARRAY_DIMENSIONS
cap bypassed
* Opcodes tableswitch and lookupswitch add boundary checks
* JustIce Pass 2 hangs on cyclic superclass chain of a referenced exception
class
* JustIce Pass 2 LVT check amplifies each 10-byte entry into ~131k hashtable
operations
* Pass 3b dataflow stores frames per instruction and clones ever-growing
execution chains
* Cubic handlers * range * subroutines scan in Subroutines constructor hangs
JustIce Pass 3b
* Subroutines.noRecursiveCalls enumerates exponentially many JSR call paths
* Disassembler and Class2HTML re-implement the unchecked switch-table
allocation
* ConstantPool.constantToString recurses forever on self-referencing
CONSTANT_MethodHandle
* Utility.typeSignatureToString recurses per generic-nesting level, unbounded,
with quadratic substring copies
* Repositories cache classes under the input-defined this_class name; global
static Repository/VerifierFactory make the poisoning ClassLoader-wide
(bsc#1284400, CVE-2026-94114)
* Silent u2/u1 count truncation across dump paths corrupts emitted bytecode
* Class2HTML emitters write attacker class-file strings into HTML unescaped
(stored XSS in reports) (bsc#1284399, CVE-2026-105111)
* Class2HTML builds output file paths from the unvalidated class name
* ClassPath.getBytes() sizes its buffer from the forged ZIP uncompressed-size
field
* PMG attribute ignores declared length, enabling BCEL-vs-JVM parse divergence
* Signature.matchGJIdent recurses unboundedly on nested generic signatures
(Signature.translate)
* Utility.decode fixed 3x buffer breaks the encode/decode round trip and
throws unchecked AIOOBE
* BCELifier interpolates attacker class/package names into generated Java
source unescaped
* Verifier pass 3a delayed checks are quadratic in attribute and code size
* Verifier cache grows unboundedly with attacker-chosen class names
* Static WIDE ThreadLocal survives exceptions, corrupting the next class's
disassembly on the same thread
* Utility.JavaReader escape decoding: OOB table index, bad-hex crash, silent
non-canonical aliasing
* Changes
* Bump org.apache.commons:commons-parent from 95 to 104
* Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20
* Bump commons-io:commons-io from 2.21.0 to 2.22.0
* Bump jna.version from 5.18.1 to 5.19.1
* [test] Bump org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0
* Changes of version 6.12.0
* Add Const.MAJOR_26
* Add Const.MINOR_26
* Fix infinite loop in example.TransitiveHull
* Fix Apache RAT plugin console warnings
* Fix malformed Javadoc comments
* Make the build reproducible on the Azul JDK
* Fix infinite loop in JavaClass.findField() on invalid input
* Fix infinite loop in JavaClass.getAllInterfaces() on invalid input
* Fix infinite loop in JavaClass.getSuperClasses() on invalid
* Exception message in Args.requireU4() refers to the wrong data type
* Exception message in Args.requireU2() refers to the wrong upper range value
* Code.Code(int, int, DataInput, ConstantPool) now throws a
ClassFormatException if the code array is greater than the JVM specification
allows
* Code.Code(int, int, int, int, byte[], CodeException[], Attribute[],
ConstantPool) now throws a ClassFormatException if the code array is greater
than the JVM specification allows
* Code.setCode(byte[]) now throws a ClassFormatException if the code array is
greater than the JVM specification allows
* ClassDumper.dump() should not call the input stream it didn't open; fixes
IOException when calling DumpClass.main (ClassDumper.java:351)
* org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[]) now uses
varagrs: ConstantPool(Constant...)
* org.apache.bcel.classfile.Deprecated now requires its the attribute_length
item be zero
* org.apache.bcel.classfile.Synthetic now requires its the
* The size of an Attribute unknown to the JVM specification is limited to 1 MB
and is overridden with the system property
BCEL.Attribute.Unknown.max_attribute_length
* Bump org.apache.commons:commons-parent from 89 to 95
* [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to 2.3.0
* Bump commons-io:commons-io from 2.20.0 to 2.21.0
* Bump commons-lang3 from 3.19.0 to 3.20.0
* [test] Bump org.apache.commons:commons-exec from 1.5.0 to 1.6.0
* Changes of version 6.11.0
* Add Const.MAJOR_25
* Add Const.MINOR_25
* Add experimental CycloneDX VEX file
* Refactor to use new Maven POM variable ecj.version
* Replace internal use of Locale.ENGLISH with Locale.ROOT
* BCEL-375: Wrong permissions on bcel .jar file in binary .tar.gz distribution
file
* BCEL-376: ClassPath.close() throws UnsupportedOperationException when
created with system-classpath
* ClassPath.getResources(String) can use an ArrayList instead of a Vector
* Fix SpotBugs [ERROR] Medium: Operation on the "created" shared variable in
"ConstantUtf8" class is not atomic [org.apache .bcel.classfile.ConstantUtf8]
At ConstantUtf8.java:[line 119] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE
* Fix SpotBugs [ERROR] Medium: Operation on the "considered" shared variable
in "ConstantUtf8" class is not atomic [org
.apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java: [line 137]
AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE
* Fix SpotBugs [ERROR] Medium: Operation on the "skipped" shared
.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134]
* org.apache.bcel.util.ClassPath .addJdkModules(String, List<String>) now
reads the system property "jdk.module.path" instead of "java.modules.path"
* Fix ConstantPoolModuleAccessTest failures on Java 25
* 377: Fix testing on Java 24 and up
* Bump org.apache.commons:commons-parent from 72 to 89
* Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0
* Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20
* Bump commons-io:commons-io from 2.16.1 to 2.20.0
* Bump jna.version from 5.14.0 to 5.18.1
* Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to 3.2.1
* Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to 4.5.0
* Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0 a minimum of Java 8
* Fix PMD UnnecessaryFullyQualifiedName
* Fix PMD EmptyCatchBlock by allowing commented blocks
* Fix PMD EmptyControlStatement by allowing commented blocks JasminVisitor
* SpotBugs checks should ignore code generated by JavaCC
* Fix SpotBugs URF_UNREAD_FIELD in ClassDumper
* Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor ASTFunAppl
Mini.Environment
* Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC
* Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[])
TransitiveHull.getIgnored()
* Add accessors to model and unit tests, Javadoc
* Add Const.MAJOR_22
* Add Const.MINOR_22
* Add Const.MAJOR_23
* Add Const.MINOR_23
* Add Const.MAJOR_24
* Add Const.MINOR_24 2.0.0 to 4.5.0-M2
* Bump org.apache.commons:commons-parent from 69 to 71 3.1.0
* Includes changes from 6.9.0 Maintenance and bug fix release
* Add Support for Java 16 records
* Add null guard for InstructionFactory.createInvoke()
* Avoid possible NullPointerException in
org.apache.bcel.classfile.DescendingVisitor.accept(E[])
AnnotationEntryGen[]) ConstantPoolGen, boolean) ElementValue[],
ConstantPoolGen) org.apache.bcel.generic.ClassGen.setMethods(Method[])
* Avoid possible NullPointerException in org.apache.bcel.generic
.ClassGen.unpackAnnotations(Attribute[])
* Avoid possible NullPointerException in org.apache.bcel
.classfile.ParameterAnnotationEntry
.createParameterAnnotationEntries(Attribute[])
org.apache.bcel.generic.ClassGen.ClassGen(JavaClass)
.FieldGenOrMethodGen.addAll(Attribute[])
* Avoid NullPointerException after calling org.apache.bcel
.classfile.MethodParameters.setParameters(MethodParameter[]) with null
.classfile.ParameterAnnotations
.setParameterAnnotationTable(ParameterAnnotationEntry[])
.classfile.LocalVariableTypeTable .setLocalVariableTable(LocalVariable[])
with null .classfile.LocalVariableTable
.classfile.LineNumberTable.setLineNumberTable(LineNumber[])
.classfile.JavaClass.setMethods(Method[] with null
.classfile.JavaClass.setInterfaces(int[]) with null
.classfile.JavaClass.setInterfaceNames(String[]) with null
.classfile.JavaClass.setFields(Field[]) with null
.classfile.JavaClass.setAttributes(Attribute[]) with null
.classfile.ConstantPool.setConstantPool(Constant[]) with null
.classfile.FieldOrMethod.setAttributes(Attribute[]) with null
.classfile.Annotations.setAnnotationTable(AnnotationEntry[])
.classfile.ArrayElementValue.ArrayElementValue(int, ElementValue[],
ConstantPool) with null .classfile.BootstrapMethod.BootstrapMethod(int,
int[]) with null .classfile.BootstrapMethod.setBootstrapArguments(int[])
with .classfile.BootstrapMethods.BootstrapMethods(int, int,
BootstrapMethod[], ConstantPool) with null .classfile.BootstrapMethods
.setBootstrapMethods(BootstrapMethod[]) with null
* Avoid NullPointerException calling org.apache.bcel.generic
.InstructionList.redirectLocalVariables(LocalVariableGen[],
InstructionHandle, InstructionHandle) with null
.InstructionList.redirectExceptionHandlers(CodeExceptionGen[],
.InstructionList.findHandle(InstructionHandle[], int[], int, int) with null
.MethodGen.setArgumentTypes(Type[]) with null
.MethodGen.setArgumentNames(String[]) with null
.MethodGen.removeRuntimeAttributes(Attribute[]) with null
.MethodGen.makeMutableVersion(AnnotationEntry[]) with null
* Bump org.apache.commons:commons-parent from 66 to 69
* Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23
* Bump commons-io:commons-io from 2.15.1 to 2.16.1
* 6.8.0 (2023-12-08) Maintenance and bug fix release ClassFormatException
input Java4Example ~ Add verifier tests on some opcodes signatures ~ Add
Const.MAJOR_20 ~ Add Const.MINOR_20 ~ Add Const.MAJOR_21 ~ Add
Const.MINOR_21 ~ [Bcelifier] stackmap support to pass JDK verifier
SE_BAD_FIELD BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH
NullPointerException not a NullPointerException ~ Test and coverage of
InstructionFactory ~ Verifier: test and coverage for SWAP instruction () in
it`()' ~ Fix null pointers in AnnotationEntry supports package-private) test
ATHROW on empty stack Select#toString(boolean) ~ Fix EmptyVisitorTestCase on
Java 21 ~ Bump commons-parent from 54 to 65 ~ Bump jna.version from 5.12.1
to 5.13.0 ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21 ~ Bump commons-io from
2.11.0 to 2.15.1 ~ Bump commons-lang3 from 3.12.0 to 3.14.0 3.1.1
* 6.7.0 (2022-11-28) Maintenance and bug fix release
* 6.6.1 (2022-10-29) Maintenance and bug fix release
* 6.6.0 (2022-10-08) Minor feature and bug fix release
* 6.5.0 (2020-06-05) Minor feature and bug fix release
* 6.4.1 (2019-09-26) Bug fix release
* 6.4.0 (2019-09-20) Feature and bug fix release requires Java 7 or higher to
run class org.apache.bcel.generic.InstructionConsts class java.lang.String
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server for SAP applications 16.0
zypper in -t patch SUSE-SLES-16.0-1923
* SUSE Linux Enterprise Server 16.0
zypper in -t patch SUSE-SLES-16.0-1923
## Package List:
* SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
* bcel-6.13.0-160000.1.1
* bcel-javadoc-6.13.0-160000.1.1
* SUSE Linux Enterprise Server 16.0 (noarch)
* bcel-6.13.0-160000.1.1
* bcel-javadoc-6.13.0-160000.1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-105111.html
* https://www.suse.com/security/cve/CVE-2026-94114.html
* https://bugzilla.suse.com/show_bug.cgi?id=1284399
* https://bugzilla.suse.com/show_bug.cgi?id=1284400
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261022/15b22e74/attachment.htm>
More information about the sle-security-updates
mailing list