<div class="container">
<h1>Security update for bcel</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:24258-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-10-16T12:21:02Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1284399">bsc#1284399</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1284400">bsc#1284400</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-105111.html">CVE-2026-105111</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-94114.html">CVE-2026-94114</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-105111</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-105111</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">2.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-105111</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-94114</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-94114</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-94114</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves two vulnerabilities can now be installed.</p>
<h2>Description:</h2>
<p>This update for bcel fixes the following issues:</p>
<ul>
<li>CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400).</li>
<li>CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399).</li>
</ul>
<p>Changes for bcel:</p>
<ul>
<li>Update to version 6.13.0</li>
<li>New Features</li>
<li>Add support for permitted subclasses</li>
<li>Add RecordComponentInfo.getAttribute(byte tag)</li>
<li>Add Const.MAJOR_27</li>
<li>Add Const.MINOR_27</li>
<li>Add and use ArrayType.isElementType(Type)</li>
<li>Add Const.MAJOR_28</li>
<li>Add Const.MINOR_28</li>
<li>Fixed Bugs</li>
<li>Fix constant pool module access test on Java 26 and above</li>
<li>Deprecate org.apache.bcel.classfile.Utility.Utility()</li>
<li>Deprecate org.apache.bcel.verifier.exc.Utility
.getStackTrace(Throwable)</li>
<li>Fix all Javadoc warnings and enforce checks by default</li>
<li>Escape constant pool names in generated HTML</li>
<li>Escape referenced names in BCELFactory Java output</li>
<li>Make wide flag thread-local in Utility.codeToString</li>
<li>Read multianewarray dimensions as unsigned byte</li>
<li>Site docs: clarify security model</li>
<li>Read ConstantDynamic indices as unsigned shorts</li>
<li>Validate index upper bound in CPInstruction, IINC and RET
setIndex</li>
<li>Use correct attribute tag in NestHost and ModuleMainClass</li>
<li>Propagate runtime-visible flag when parsing parameter
annotations</li>
<li>Use fixedLength for parsed LOOKUPSWITCH length</li>
<li>Fix ConstantPoolGen dedup key collisions for names with
delimiters</li>
<li>Read unsigned bytecode operands in CodeHTML disassembler</li>
<li>Deep-copy bootstrap arguments array in BootstrapMethod.copy()</li>
<li>Use exclusive live-range end in LocalVariableTable
.getLocalVariable</li>
<li>Build TABLESWITCH from sorted arrays in SWITCH</li>
<li>Use array element type not basic type for primitive array
access</li>
<li>Set length in INVOKEDYNAMIC constructor</li>
<li>Reject CALOAD on non-char arrays in structural verification</li>
<li>Add negative verifier tests for remaining array load/store
component type checks</li>
<li>Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY</li>
<li>Match wide local variable instruction length to dumped bytes</li>
<li>Bound IINC increment to signed short</li>
<li>Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8</li>
<li>Nested Code/Record attributes drive unbounded parse-time
recursion in ClassParser</li>
<li>Nested annotation element values recurse unboundedly;
MAX_ARRAY_DIMENSIONS cap bypassed</li>
<li>Opcodes tableswitch and lookupswitch add boundary checks</li>
<li>JustIce Pass 2 hangs on cyclic superclass chain of a
referenced exception class</li>
<li>JustIce Pass 2 LVT check amplifies each 10-byte entry into
~131k hashtable operations</li>
<li>Pass 3b dataflow stores frames per instruction and clones
ever-growing execution chains</li>
<li>Cubic handlers * range * subroutines scan in Subroutines
constructor hangs JustIce Pass 3b</li>
<li>Subroutines.noRecursiveCalls enumerates exponentially many JSR
call paths</li>
<li>Disassembler and Class2HTML re-implement the unchecked
switch-table allocation</li>
<li>ConstantPool.constantToString recurses forever on
self-referencing CONSTANT_MethodHandle</li>
<li>Utility.typeSignatureToString recurses per generic-nesting
level, unbounded, with quadratic substring copies</li>
<li>Repositories cache classes under the input-defined this_class
name; global static Repository/VerifierFactory make the
poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114)</li>
<li>Silent u2/u1 count truncation across dump paths corrupts
emitted bytecode</li>
<li>Class2HTML emitters write attacker class-file strings into
HTML unescaped (stored XSS in reports) (bsc#1284399,
CVE-2026-105111)</li>
<li>Class2HTML builds output file paths from the unvalidated class
name</li>
<li>ClassPath.getBytes() sizes its buffer from the forged ZIP
uncompressed-size field</li>
<li>PMG attribute ignores declared length, enabling BCEL-vs-JVM
parse divergence</li>
<li>Signature.matchGJIdent recurses unboundedly on nested generic
signatures (Signature.translate)</li>
<li>Utility.decode fixed 3x buffer breaks the encode/decode round
trip and throws unchecked AIOOBE</li>
<li>BCELifier interpolates attacker class/package names into
generated Java source unescaped</li>
<li>Verifier pass 3a delayed checks are quadratic in attribute and
code size</li>
<li>Verifier cache grows unboundedly with attacker-chosen class
names</li>
<li>Static WIDE ThreadLocal survives exceptions, corrupting the
next class's disassembly on the same thread</li>
<li>Utility.JavaReader escape decoding: OOB table index, bad-hex
crash, silent non-canonical aliasing</li>
<li>Changes</li>
<li>Bump org.apache.commons:commons-parent from 95 to 104</li>
<li>Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20</li>
<li>Bump commons-io:commons-io from 2.21.0 to 2.22.0</li>
<li>Bump jna.version from 5.18.1 to 5.19.1</li>
<li>[test] Bump org.apache.commons:commons-collections4 from 4.5.0
to 4.6.0</li>
<li>Changes of version 6.12.0</li>
<li>Add Const.MAJOR_26</li>
<li>Add Const.MINOR_26</li>
<li>Fix infinite loop in example.TransitiveHull</li>
<li>Fix Apache RAT plugin console warnings</li>
<li>Fix malformed Javadoc comments</li>
<li>Make the build reproducible on the Azul JDK</li>
<li>Fix infinite loop in JavaClass.findField() on invalid input</li>
<li>Fix infinite loop in JavaClass.getAllInterfaces() on invalid
input</li>
<li>Fix infinite loop in JavaClass.getSuperClasses() on invalid</li>
<li>Exception message in Args.requireU4() refers to the wrong data
type</li>
<li>Exception message in Args.requireU2() refers to the wrong
upper range value</li>
<li>Code.Code(int, int, DataInput, ConstantPool) now throws a
ClassFormatException if the code array is greater than the
JVM specification allows</li>
<li>Code.Code(int, int, int, int, byte[], CodeException[],
Attribute[], ConstantPool) now throws a ClassFormatException
if the code array is greater than the JVM specification allows</li>
<li>Code.setCode(byte[]) now throws a ClassFormatException if the
code array is greater than the JVM specification allows</li>
<li>ClassDumper.dump() should not call the input stream it didn't
open; fixes IOException when calling DumpClass.main
(ClassDumper.java:351)</li>
<li>org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[])
now uses varagrs: ConstantPool(Constant...)</li>
<li>org.apache.bcel.classfile.Deprecated now requires its the
attribute_length item be zero</li>
<li>org.apache.bcel.classfile.Synthetic now requires its the</li>
<li>The size of an Attribute unknown to the JVM specification is
limited to 1 MB and is overridden with the system property
BCEL.Attribute.Unknown.max_attribute_length</li>
<li>Bump org.apache.commons:commons-parent from 89 to 95</li>
<li>[test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to
2.3.0</li>
<li>Bump commons-io:commons-io from 2.20.0 to 2.21.0</li>
<li>Bump commons-lang3 from 3.19.0 to 3.20.0</li>
<li>[test] Bump org.apache.commons:commons-exec from 1.5.0 to
1.6.0</li>
<li>Changes of version 6.11.0</li>
<li>Add Const.MAJOR_25</li>
<li>Add Const.MINOR_25</li>
<li>Add experimental CycloneDX VEX file</li>
<li>Refactor to use new Maven POM variable ecj.version</li>
<li>Replace internal use of Locale.ENGLISH with Locale.ROOT</li>
<li>BCEL-375: Wrong permissions on bcel .jar file in binary
.tar.gz distribution file</li>
<li>BCEL-376: ClassPath.close() throws
UnsupportedOperationException when created with
system-classpath</li>
<li>ClassPath.getResources(String) can use an ArrayList instead of
a Vector</li>
<li>Fix SpotBugs [ERROR] Medium: Operation on the "created" shared
variable in "ConstantUtf8" class is not atomic [org.apache
.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119]
AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE</li>
<li>Fix SpotBugs [ERROR] Medium: Operation on the "considered"
shared variable in "ConstantUtf8" class is not atomic [org
.apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:
[line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE</li>
<li>Fix SpotBugs [ERROR] Medium: Operation on the "skipped" shared
.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134]</li>
<li>org.apache.bcel.util.ClassPath
.addJdkModules(String, List<String>) now reads the system
property "jdk.module.path" instead of "java.modules.path"</li>
<li>Fix ConstantPoolModuleAccessTest failures on Java 25</li>
<li>377: Fix testing on Java 24 and up</li>
<li>Bump org.apache.commons:commons-parent from 72 to 89</li>
<li>Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0</li>
<li>Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20</li>
<li>Bump commons-io:commons-io from 2.16.1 to 2.20.0</li>
<li>Bump jna.version from 5.14.0 to 5.18.1</li>
<li>Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to
3.2.1</li>
<li>Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to
4.5.0</li>
<li>Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0
a minimum of Java 8</li>
<li>Fix PMD UnnecessaryFullyQualifiedName</li>
<li>Fix PMD EmptyCatchBlock by allowing commented blocks</li>
<li>Fix PMD EmptyControlStatement by allowing commented blocks
JasminVisitor</li>
<li>SpotBugs checks should ignore code generated by JavaCC</li>
<li>Fix SpotBugs URF_UNREAD_FIELD in ClassDumper</li>
<li>Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor
ASTFunAppl
Mini.Environment</li>
<li>Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC</li>
<li>Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[])
TransitiveHull.getIgnored()</li>
<li>Add accessors to model and unit tests, Javadoc</li>
<li>Add Const.MAJOR_22</li>
<li>Add Const.MINOR_22</li>
<li>Add Const.MAJOR_23</li>
<li>Add Const.MINOR_23</li>
<li>Add Const.MAJOR_24</li>
<li>Add Const.MINOR_24
2.0.0
to 4.5.0-M2</li>
<li>Bump org.apache.commons:commons-parent from 69 to 71
3.1.0</li>
<li>Includes changes from 6.9.0 Maintenance and bug fix release</li>
<li>Add Support for Java 16 records</li>
<li>Add null guard for InstructionFactory.createInvoke()</li>
<li>Avoid possible NullPointerException in
org.apache.bcel.classfile.DescendingVisitor.accept(E[])
AnnotationEntryGen[])
ConstantPoolGen, boolean)
ElementValue[], ConstantPoolGen)
org.apache.bcel.generic.ClassGen.setMethods(Method[])</li>
<li>Avoid possible NullPointerException in org.apache.bcel.generic
.ClassGen.unpackAnnotations(Attribute[])</li>
<li>Avoid possible NullPointerException in org.apache.bcel
.classfile.ParameterAnnotationEntry
.createParameterAnnotationEntries(Attribute[])
org.apache.bcel.generic.ClassGen.ClassGen(JavaClass)
.FieldGenOrMethodGen.addAll(Attribute[])</li>
<li>Avoid NullPointerException after calling org.apache.bcel
.classfile.MethodParameters.setParameters(MethodParameter[])
with null
.classfile.ParameterAnnotations
.setParameterAnnotationTable(ParameterAnnotationEntry[])
.classfile.LocalVariableTypeTable
.setLocalVariableTable(LocalVariable[]) with null
.classfile.LocalVariableTable
.classfile.LineNumberTable.setLineNumberTable(LineNumber[])
.classfile.JavaClass.setMethods(Method[] with null
.classfile.JavaClass.setInterfaces(int[]) with null
.classfile.JavaClass.setInterfaceNames(String[]) with null
.classfile.JavaClass.setFields(Field[]) with null
.classfile.JavaClass.setAttributes(Attribute[]) with null
.classfile.ConstantPool.setConstantPool(Constant[]) with null
.classfile.FieldOrMethod.setAttributes(Attribute[]) with null
.classfile.Annotations.setAnnotationTable(AnnotationEntry[])
.classfile.ArrayElementValue.ArrayElementValue(int,
ElementValue[], ConstantPool) with null
.classfile.BootstrapMethod.BootstrapMethod(int, int[]) with
null
.classfile.BootstrapMethod.setBootstrapArguments(int[]) with
.classfile.BootstrapMethods.BootstrapMethods(int, int,
BootstrapMethod[], ConstantPool) with null
.classfile.BootstrapMethods
.setBootstrapMethods(BootstrapMethod[]) with null</li>
<li>Avoid NullPointerException calling org.apache.bcel.generic
.InstructionList.redirectLocalVariables(LocalVariableGen[],
InstructionHandle, InstructionHandle) with null
.InstructionList.redirectExceptionHandlers(CodeExceptionGen[],
.InstructionList.findHandle(InstructionHandle[], int[], int,
int) with null
.MethodGen.setArgumentTypes(Type[]) with null
.MethodGen.setArgumentNames(String[]) with null
.MethodGen.removeRuntimeAttributes(Attribute[]) with null
.MethodGen.makeMutableVersion(AnnotationEntry[]) with null</li>
<li>Bump org.apache.commons:commons-parent from 66 to 69</li>
<li>Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23</li>
<li>Bump commons-io:commons-io from 2.15.1 to 2.16.1</li>
<li>6.8.0 (2023-12-08) Maintenance and bug fix release
ClassFormatException
input Java4Example
~ Add verifier tests on some opcodes
signatures
~ Add Const.MAJOR_20
~ Add Const.MINOR_20
~ Add Const.MAJOR_21
~ Add Const.MINOR_21
~ [Bcelifier] stackmap support to pass JDK verifier
SE_BAD_FIELD
BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH
NullPointerException
not a NullPointerException
~ Test and coverage of InstructionFactory
~ Verifier: test and coverage for SWAP instruction
() in it`()'
~ Fix null pointers in AnnotationEntry
supports package-private)
test
ATHROW on empty stack
Select#toString(boolean)
~ Fix EmptyVisitorTestCase on Java 21
~ Bump commons-parent from 54 to 65
~ Bump jna.version from 5.12.1 to 5.13.0
~ Bump kotlin-stdlib from 1.8.10 to 1.9.21
~ Bump commons-io from 2.11.0 to 2.15.1
~ Bump commons-lang3 from 3.12.0 to 3.14.0
3.1.1</li>
<li>6.7.0 (2022-11-28) Maintenance and bug fix release</li>
<li>6.6.1 (2022-10-29) Maintenance and bug fix release</li>
<li>6.6.0 (2022-10-08) Minor feature and bug fix release</li>
<li>6.5.0 (2020-06-05) Minor feature and bug fix release</li>
<li>6.4.1 (2019-09-26) Bug fix release</li>
<li>6.4.0 (2019-09-20) Feature and bug fix release
requires Java 7 or higher to run
class
org.apache.bcel.generic.InstructionConsts class
java.lang.String</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1923</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1923</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
<ul>
<li>bcel-6.13.0-160000.1.1</li>
<li>bcel-javadoc-6.13.0-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>
<li>bcel-6.13.0-160000.1.1</li>
<li>bcel-javadoc-6.13.0-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-105111.html">https://www.suse.com/security/cve/CVE-2026-105111.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-94114.html">https://www.suse.com/security/cve/CVE-2026-94114.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1284399">https://bugzilla.suse.com/show_bug.cgi?id=1284399</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1284400">https://bugzilla.suse.com/show_bug.cgi?id=1284400</a>
</li>
</ul>
</div>