debian/bcel vulnerabilities

Latest debian/bcel CVEs

Newest publication first

1. CVE-2026-105111 Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

   Published 2026-10-06

   Low·CVSS 2.3 EPSS 0.25%

   Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker cl...

2. CVE-2026-94114 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

   Published 2026-10-06

   High·CVSS 8.2 EPSS 0.28%

   Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Comm...

3. CVE-2022-42920 Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

   Published 2022-11-07

   Critical·CVSS 9.8 EPSS 3.5%

   Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controlla...

4. DSA-5256-1 bcel - security update

   Published 2022-10-18

   Unknown

5. DLA-3155-1 bcel - security update

   Published 2022-10-18

   Unknown

6. CVE-2022-34169 Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

   Published 2022-07-19

   High·CVSS 7.5 EPSS 81.8% Public exploit

   The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.