--===============7446652816113714015==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

# Security update for bcel

Announcement ID: SUSE-SU-2026:24258-1
Release Date: 2026-10-16T12:21:02Z
Rating: moderate
References:

* bsc#1284399
* bsc#1284400

Cross-References:

* CVE-2026-105111
* CVE-2026-94114

CVSS scores:

* CVE-2026-105111 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-105111 ( NVD ): 2.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-105111 ( NVD ): 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-94114 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-94114 ( NVD ): 8.2

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-94114 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products:

* SUSE Linux Enterprise Server 16.0
* SUSE Linux Enterprise Server for SAP applications 16.0

An update that solves two vulnerabilities can now be installed.

## Description:

This update for bcel fixes the following issues:

* CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time
recursion in ClassParser (bsc#1284400).
* CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored
XSS (bsc#1284399).

Changes for bcel:

* Update to version 6.13.0
* New Features
* Add support for permitted subclasses
* Add RecordComponentInfo.getAttribute(byte tag)
* Add Const.MAJOR_27
* Add Const.MINOR_27
* Add and use ArrayType.isElementType(Type)
* Add Const.MAJOR_28
* Add Const.MINOR_28
* Fixed Bugs
* Fix constant pool module access test on Java 26 and above
* Deprecate org.apache.bcel.classfile.Utility.Utility()
* Deprecate org.apache.bcel.verifier.exc.Utility .getStackTrace(Throwable)
* Fix all Javadoc warnings and enforce checks by default
* Escape constant pool names in generated HTML
* Escape referenced names in BCELFactory Java output
* Make wide flag thread-local in Utility.codeToString
* Read multianewarray dimensions as unsigned byte
* Site docs: clarify security model
* Read ConstantDynamic indices as unsigned shorts
* Validate index upper bound in CPInstruction, IINC and RET setIndex
* Use correct attribute tag in NestHost and ModuleMainClass
* Propagate runtime-visible flag when parsing parameter annotations
* Use fixedLength for parsed LOOKUPSWITCH length
* Fix ConstantPoolGen dedup key collisions for names with delimiters
* Read unsigned bytecode operands in CodeHTML disassembler
* Deep-copy bootstrap arguments array in BootstrapMethod.copy()
* Use exclusive live-range end in LocalVariableTable .getLocalVariable
* Build TABLESWITCH from sorted arrays in SWITCH
* Use array element type not basic type for primitive array access
* Set length in INVOKEDYNAMIC constructor
* Reject CALOAD on non-char arrays in structural verification
* Add negative verifier tests for remaining array load/store component type
checks
* Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY
* Match wide local variable instruction length to dumped bytes
* Bound IINC increment to signed short
* Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8
* Nested Code/Record attributes drive unbounded parse-time recursion in
ClassParser
* Nested annotation element values recurse unboundedly; MAX_ARRAY_DIMENSIONS
cap bypassed
* Opcodes tableswitch and lookupswitch add boundary checks
* JustIce Pass 2 hangs on cyclic superclass chain of a referenced exception
class
* JustIce Pass 2 LVT check amplifies each 10-byte entry into ~131k hashtable
operations
* Pass 3b dataflow stores frames per instruction and clones ever-growing
execution chains
* Cubic handlers * range * subroutines scan in Subroutines constructor hangs
JustIce Pass 3b
* Subroutines.noRecursiveCalls enumerates exponentially many JSR call paths
* Disassembler and Class2HTML re-implement the unchecked switch-table
allocation
* ConstantPool.constantToString recurses forever on self-referencing
CONSTANT_MethodHandle
* Utility.typeSignatureToString recurses per generic-nesting level,
unbounded,
with quadratic substring copies
* Repositories cache classes under the input-defined this_class name; global
static Repository/VerifierFactory make the poisoning ClassLoader-wide
(bsc#1284400, CVE-2026-94114)
* Silent u2/u1 count truncation across dump paths corrupts emitted bytecode
* Class2HTML emitters write attacker class-file strings into HTML unescaped
(stored XSS in reports) (bsc#1284399, CVE-2026-105111)
* Class2HTML builds output file paths from the unvalidated class name
* ClassPath.getBytes() sizes its buffer from the forged ZIP uncompressed-size
field
* PMG attribute ignores declared length, enabling BCEL-vs-JVM parse
divergence
* Signature.matchGJIdent recurses unboundedly on nested generic signatures
(Signature.translate)
* Utility.decode fixed 3x buffer breaks the encode/decode round trip and
throws unchecked AIOOBE
* BCELifier interpolates attacker class/package names into generated Java
source unescaped
* Verifier pass 3a delayed checks are quadratic in attribute and code size
* Verifier cache grows unboundedly with attacker-chosen class names
* Static WIDE ThreadLocal survives exceptions, corrupting the next
class's
disassembly on the same thread
* Utility.JavaReader escape decoding: OOB table index, bad-hex crash, silent
non-canonical aliasing
* Changes
* Bump org.apache.commons:commons-parent from 95 to 104
* Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20
* Bump commons-io:commons-io from 2.21.0 to 2.22.0
* Bump jna.version from 5.18.1 to 5.19.1
* [test] Bump org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0
* Changes of version 6.12.0
* Add Const.MAJOR_26
* Add Const.MINOR_26
* Fix infinite loop in example.TransitiveHull
* Fix Apache RAT plugin console warnings
* Fix malformed Javadoc comments
* Make the build reproducible on the Azul JDK
* Fix infinite loop in JavaClass.findField() on invalid input
* Fix infinite loop in JavaClass.getAllInterfaces() on invalid input
* Fix infinite loop in JavaClass.getSuperClasses() on invalid
* Exception message in Args.requireU4() refers to the wrong data type
* Exception message in Args.requireU2() refers to the wrong upper range value
* Code.Code(int, int, DataInput, ConstantPool) now throws a
ClassFormatException if the code array is greater than the JVM
specification
allows
* Code.Code(int, int, int, int, byte[], CodeException[], Attribute[],
ConstantPool) now throws a ClassFormatException if the code array is
greater
than the JVM specification allows
* Code.setCode(byte[]) now throws a ClassFormatException if the code array is
greater than the JVM specification allows
* ClassDumper.dump() should not call the input stream it didn't open;
fixes
IOException when calling DumpClass.main (ClassDumper.java:351)
* org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[]) now uses
varagrs: ConstantPool(Constant...)
* org.apache.bcel.classfile.Deprecated now requires its the attribute_length
item be zero
* org.apache.bcel.classfile.Synthetic now requires its the
* The size of an Attribute unknown to the JVM specification is limited to 1
MB
and is overridden with the system property
BCEL.Attribute.Unknown.max_attribute_length
* Bump org.apache.commons:commons-parent from 89 to 95
* [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to 2.3.0
* Bump commons-io:commons-io from 2.20.0 to 2.21.0
* Bump commons-lang3 from 3.19.0 to 3.20.0
* [test] Bump org.apache.commons:commons-exec from 1.5.0 to 1.6.0
* Changes of version 6.11.0
* Add Const.MAJOR_25
* Add Const.MINOR_25
* Add experimental CycloneDX VEX file
* Refactor to use new Maven POM variable ecj.version
* Replace internal use of Locale.ENGLISH with Locale.ROOT
* BCEL-375: Wrong permissions on bcel .jar file in binary .tar.gz
distribution
file
* BCEL-376: ClassPath.close() throws UnsupportedOperationException when
created with system-classpath
* ClassPath.getResources(String) can use an ArrayList instead of a Vector
* Fix SpotBugs [ERROR] Medium: Operation on the "created" shared
variable in
"ConstantUtf8" class is not atomic [org.apache
.bcel.classfile.ConstantUtf8]
At ConstantUtf8.java:[line 119] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE
* Fix SpotBugs [ERROR] Medium: Operation on the "considered" shared
variable
in "ConstantUtf8" class is not atomic [org
.apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java: [line 137]
AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE
* Fix SpotBugs [ERROR] Medium: Operation on the "skipped" shared
.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134]
* org.apache.bcel.util.ClassPath .addJdkModules(String, List<String>)
now
reads the system property "jdk.module.path" instead of
"java.modules.path"
* Fix ConstantPoolModuleAccessTest failures on Java 25
* 377: Fix testing on Java 24 and up
* Bump org.apache.commons:commons-parent from 72 to 89
* Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0
* Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20
* Bump commons-io:commons-io from 2.16.1 to 2.20.0
* Bump jna.version from 5.14.0 to 5.18.1
* Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to 3.2.1
* Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to 4.5.0
* Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0 a minimum of Java
8
* Fix PMD UnnecessaryFullyQualifiedName
* Fix PMD EmptyCatchBlock by allowing commented blocks
* Fix PMD EmptyControlStatement by allowing commented blocks JasminVisitor
* SpotBugs checks should ignore code generated by JavaCC
* Fix SpotBugs URF_UNREAD_FIELD in ClassDumper
* Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor ASTFunAppl
Mini.Environment
* Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC
* Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[])
TransitiveHull.getIgnored()
* Add accessors to model and unit tests, Javadoc
* Add Const.MAJOR_22
* Add Const.MINOR_22
* Add Const.MAJOR_23
* Add Const.MINOR_23
* Add Const.MAJOR_24
* Add Const.MINOR_24 2.0.0 to 4.5.0-M2
* Bump org.apache.commons:commons-parent from 69 to 71 3.1.0
* Includes changes from 6.9.0 Maintenance and bug fix release
* Add Support for Java 16 records
* Add null guard for InstructionFactory.createInvoke()
* Avoid possible NullPointerException in
org.apache.bcel.classfile.DescendingVisitor.accept(E[])
AnnotationEntryGen[]) ConstantPoolGen, boolean) ElementValue[],
ConstantPoolGen) org.apache.bcel.generic.ClassGen.setMethods(Method[])
* Avoid possible NullPointerException in org.apache.bcel.generic
.ClassGen.unpackAnnotations(Attribute[])
* Avoid possible NullPointerException in org.apache.bcel
.classfile.ParameterAnnotationEntry
.createParameterAnnotationEntries(Attribute[])
org.apache.bcel.generic.ClassGen.ClassGen(JavaClass)
.FieldGenOrMethodGen.addAll(Attribute[])
* Avoid NullPointerException after calling org.apache.bcel
.classfile.MethodParameters.setParameters(MethodParameter[]) with null
.classfile.ParameterAnnotations
.setParameterAnnotationTable(ParameterAnnotationEntry[])
.classfile.LocalVariableTypeTable .setLocalVariableTable(LocalVariable[])
with null .classfile.LocalVariableTable
.classfile.LineNumberTable.setLineNumberTable(LineNumber[])
.classfile.JavaClass.setMethods(Method[] with null
.classfile.JavaClass.setInterfaces(int[]) with null
.classfile.JavaClass.setInterfaceNames(String[]) with null
.classfile.JavaClass.setFields(Field[]) with null
.classfile.JavaClass.setAttributes(Attribute[]) with null
.classfile.ConstantPool.setConstantPool(Constant[]) with null
.classfile.FieldOrMethod.setAttributes(Attribute[]) with null
.classfile.Annotations.setAnnotationTable(AnnotationEntry[])
.classfile.ArrayElementValue.ArrayElementValue(int, ElementValue[],
ConstantPool) with null .classfile.BootstrapMethod.BootstrapMethod(int,
int[]) with null .classfile.BootstrapMethod.setBootstrapArguments(int[])
with .classfile.BootstrapMethods.BootstrapMethods(int, int,
BootstrapMethod[], ConstantPool) with null .classfile.BootstrapMethods
.setBootstrapMethods(BootstrapMethod[]) with null
* Avoid NullPointerException calling org.apache.bcel.generic
.InstructionList.redirectLocalVariables(LocalVariableGen[],
InstructionHandle, InstructionHandle) with null
.InstructionList.redirectExceptionHandlers(CodeExceptionGen[],
.InstructionList.findHandle(InstructionHandle[], int[], int, int) with null
.MethodGen.setArgumentTypes(Type[]) with null
.MethodGen.setArgumentNames(String[]) with null
.MethodGen.removeRuntimeAttributes(Attribute[]) with null
.MethodGen.makeMutableVersion(AnnotationEntry[]) with null
* Bump org.apache.commons:commons-parent from 66 to 69
* Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23
* Bump commons-io:commons-io from 2.15.1 to 2.16.1
* 6.8.0 (2023-12-08) Maintenance and bug fix release ClassFormatException
input Java4Example ~ Add verifier tests on some opcodes signatures ~ Add
Const.MAJOR_20 ~ Add Const.MINOR_20 ~ Add Const.MAJOR_21 ~ Add
Const.MINOR_21 ~ [Bcelifier] stackmap support to pass JDK verifier
SE_BAD_FIELD BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH
NullPointerException not a NullPointerException ~ Test and coverage of
InstructionFactory ~ Verifier: test and coverage for SWAP instruction () in
it`()' ~ Fix null pointers in AnnotationEntry supports package-private)
test
ATHROW on empty stack Select#toString(boolean) ~ Fix EmptyVisitorTestCase
on
Java 21 ~ Bump commons-parent from 54 to 65 ~ Bump jna.version from 5.12.1
to 5.13.0 ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21 ~ Bump commons-io from
2.11.0 to 2.15.1 ~ Bump commons-lang3 from 3.12.0 to 3.14.0 3.1.1
* 6.7.0 (2022-11-28) Maintenance and bug fix release
* 6.6.1 (2022-10-29) Maintenance and bug fix release
* 6.6.0 (2022-10-08) Minor feature and bug fix release
* 6.5.0 (2020-06-05) Minor feature and bug fix release
* 6.4.1 (2019-09-26) Bug fix release
* 6.4.0 (2019-09-20) Feature and bug fix release requires Java 7 or higher to
run class org.apache.bcel.generic.InstructionConsts class java.lang.String

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server for SAP applications 16.0
zypper in -t patch SUSE-SLES-16.0-1923

* SUSE Linux Enterprise Server 16.0
zypper in -t patch SUSE-SLES-16.0-1923

## Package List:

* SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
* bcel-6.13.0-160000.1.1
* bcel-javadoc-6.13.0-160000.1.1
* SUSE Linux Enterprise Server 16.0 (noarch)
* bcel-6.13.0-160000.1.1
* bcel-javadoc-6.13.0-160000.1.1

## References:

* https://www.suse.com/security/cve/CVE-2026-105111.html
* https://www.suse.com/security/cve/CVE-2026-94114.html
* https://bugzilla.suse.com/show_bug.cgi?id=1284399
* https://bugzilla.suse.com/show_bug.cgi?id=1284400

--===============7446652816113714015==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

<div class="container">
<h1>Security update for bcel</h1>

<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:24258-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-10-16T12:21:02Z</td>
</tr>

<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>

<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1284399">bsc#1284399</a>
</li>

<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1284400">bsc#1284400</a>
</li>

</ul>
</td>
</tr>

<tr>
<th>
Cross-References:
</th>
<td>
<ul>

<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-105111.html">CVE-2026-105111</a>
</li>

<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-94114.html">CVE-2026-94114</a>
</li>

</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-105111</span>
<span class="cvss-source">
(

SUSE

):
</span>
<span
class="cvss-score">4.7</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-105111</span>
<span class="cvss-source">
(

NVD

):
</span>
<span
class="cvss-score">2.3</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-105111</span>
<span class="cvss-source">
(

NVD

):
</span>
<span
class="cvss-score">4.7</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-94114</span>
<span class="cvss-source">
(

SUSE

):
</span>
<span
class="cvss-score">5.9</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-94114</span>
<span class="cvss-source">
(

NVD

):
</span>
<span
class="cvss-score">8.2</span>
<span
class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>

<li class="list-group-item">
<span
class="cvss-reference">CVE-2026-94114</span>
<span class="cvss-source">
(

NVD

):
</span>
<span
class="cvss-score">5.9</span>
<span
class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>

</ul>
</td>
</tr>

<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">

<li class="list-group-item">SUSE Linux
Enterprise Server 16.0</li>

<li class="list-group-item">SUSE Linux
Enterprise Server for SAP applications 16.0</li>

</ul>
</td>
</tr>
</tbody>
</table>

<p>An update that solves two vulnerabilities can now be
installed.</p>

<h2>Description:</h2>

<p>This update for bcel fixes the following issues:</p>
<ul>
<li>CVE-2026-94114: Nested Code/Record attributes drive unbounded
parse-time recursion in ClassParser (bsc#1284400).</li>
<li>CVE-2026-105111: Class2HTML emits unescaped class strings, enabling
stored XSS (bsc#1284399).</li>
</ul>
<p>Changes for bcel:</p>
<ul>
<li>Update to version 6.13.0</li>
<li>New Features</li>
<li>Add support for permitted subclasses</li>
<li>Add RecordComponentInfo.getAttribute(byte tag)</li>
<li>Add Const.MAJOR_27</li>
<li>Add Const.MINOR_27</li>
<li>Add and use ArrayType.isElementType(Type)</li>
<li>Add Const.MAJOR_28</li>
<li>Add Const.MINOR_28</li>
<li>Fixed Bugs</li>
<li>Fix constant pool module access test on Java 26 and above</li>
<li>Deprecate org.apache.bcel.classfile.Utility.Utility()</li>
<li>Deprecate org.apache.bcel.verifier.exc.Utility
.getStackTrace(Throwable)</li>
<li>Fix all Javadoc warnings and enforce checks by default</li>
<li>Escape constant pool names in generated HTML</li>
<li>Escape referenced names in BCELFactory Java output</li>
<li>Make wide flag thread-local in Utility.codeToString</li>
<li>Read multianewarray dimensions as unsigned byte</li>
<li>Site docs: clarify security model</li>
<li>Read ConstantDynamic indices as unsigned shorts</li>
<li>Validate index upper bound in CPInstruction, IINC and RET
setIndex</li>
<li>Use correct attribute tag in NestHost and ModuleMainClass</li>
<li>Propagate runtime-visible flag when parsing parameter
annotations</li>
<li>Use fixedLength for parsed LOOKUPSWITCH length</li>
<li>Fix ConstantPoolGen dedup key collisions for names with
delimiters</li>
<li>Read unsigned bytecode operands in CodeHTML disassembler</li>
<li>Deep-copy bootstrap arguments array in
BootstrapMethod.copy()</li>
<li>Use exclusive live-range end in LocalVariableTable
.getLocalVariable</li>
<li>Build TABLESWITCH from sorted arrays in SWITCH</li>
<li>Use array element type not basic type for primitive array
access</li>
<li>Set length in INVOKEDYNAMIC constructor</li>
<li>Reject CALOAD on non-char arrays in structural
verification</li>
<li>Add negative verifier tests for remaining array load/store
component type checks</li>
<li>Validate u1 count bound in INVOKEINTERFACE and
MULTIANEWARRAY</li>
<li>Match wide local variable instruction length to dumped
bytes</li>
<li>Bound IINC increment to signed short</li>
<li>Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in
ConstantUtf8</li>
<li>Nested Code/Record attributes drive unbounded parse-time
recursion in ClassParser</li>
<li>Nested annotation element values recurse unboundedly;
MAX_ARRAY_DIMENSIONS cap bypassed</li>
<li>Opcodes tableswitch and lookupswitch add boundary checks</li>
<li>JustIce Pass 2 hangs on cyclic superclass chain of a
referenced exception class</li>
<li>JustIce Pass 2 LVT check amplifies each 10-byte entry into
~131k hashtable operations</li>
<li>Pass 3b dataflow stores frames per instruction and clones
ever-growing execution chains</li>
<li>Cubic handlers * range * subroutines scan in Subroutines
constructor hangs JustIce Pass 3b</li>
<li>Subroutines.noRecursiveCalls enumerates exponentially many JSR
call paths</li>
<li>Disassembler and Class2HTML re-implement the unchecked
switch-table allocation</li>
<li>ConstantPool.constantToString recurses forever on
self-referencing CONSTANT_MethodHandle</li>
<li>Utility.typeSignatureToString recurses per generic-nesting
level, unbounded, with quadratic substring copies</li>
<li>Repositories cache classes under the input-defined this_class
name; global static Repository/VerifierFactory make the
poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114)</li>
<li>Silent u2/u1 count truncation across dump paths corrupts
emitted bytecode</li>
<li>Class2HTML emitters write attacker class-file strings into
HTML unescaped (stored XSS in reports) (bsc#1284399,
CVE-2026-105111)</li>
<li>Class2HTML builds output file paths from the unvalidated class
name</li>
<li>ClassPath.getBytes() sizes its buffer from the forged ZIP
uncompressed-size field</li>
<li>PMG attribute ignores declared length, enabling BCEL-vs-JVM
parse divergence</li>
<li>Signature.matchGJIdent recurses unboundedly on nested generic
signatures (Signature.translate)</li>
<li>Utility.decode fixed 3x buffer breaks the encode/decode round
trip and throws unchecked AIOOBE</li>
<li>BCELifier interpolates attacker class/package names into
generated Java source unescaped</li>
<li>Verifier pass 3a delayed checks are quadratic in attribute and
code size</li>
<li>Verifier cache grows unboundedly with attacker-chosen class
names</li>
<li>Static WIDE ThreadLocal survives exceptions, corrupting the
next class&#x27;s disassembly on the same thread</li>
<li>Utility.JavaReader escape decoding: OOB table index, bad-hex
crash, silent non-canonical aliasing</li>
<li>Changes</li>
<li>Bump org.apache.commons:commons-parent from 95 to 104</li>
<li>Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to
2.4.20</li>
<li>Bump commons-io:commons-io from 2.21.0 to 2.22.0</li>
<li>Bump jna.version from 5.18.1 to 5.19.1</li>
<li>[test] Bump org.apache.commons:commons-collections4 from 4.5.0
to 4.6.0</li>
<li>Changes of version 6.12.0</li>
<li>Add Const.MAJOR_26</li>
<li>Add Const.MINOR_26</li>
<li>Fix infinite loop in example.TransitiveHull</li>
<li>Fix Apache RAT plugin console warnings</li>
<li>Fix malformed Javadoc comments</li>
<li>Make the build reproducible on the Azul JDK</li>
<li>Fix infinite loop in JavaClass.findField() on invalid
input</li>
<li>Fix infinite loop in JavaClass.getAllInterfaces() on invalid
input</li>
<li>Fix infinite loop in JavaClass.getSuperClasses() on
invalid</li>
<li>Exception message in Args.requireU4() refers to the wrong data
type</li>
<li>Exception message in Args.requireU2() refers to the wrong
upper range value</li>
<li>Code.Code(int, int, DataInput, ConstantPool) now throws a
ClassFormatException if the code array is greater than the
JVM specification allows</li>
<li>Code.Code(int, int, int, int, byte[], CodeException[],
Attribute[], ConstantPool) now throws a ClassFormatException
if the code array is greater than the JVM specification allows</li>
<li>Code.setCode(byte[]) now throws a ClassFormatException if the
code array is greater than the JVM specification allows</li>
<li>ClassDumper.dump() should not call the input stream it
didn&#x27;t
open; fixes IOException when calling DumpClass.main
(ClassDumper.java:351)</li>
<li>org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[])
now uses varagrs: ConstantPool(Constant...)</li>
<li>org.apache.bcel.classfile.Deprecated now requires its the
attribute_length item be zero</li>
<li>org.apache.bcel.classfile.Synthetic now requires its the</li>
<li>The size of an Attribute unknown to the JVM specification is
limited to 1 MB and is overridden with the system property
BCEL.Attribute.Unknown.max_attribute_length</li>
<li>Bump org.apache.commons:commons-parent from 89 to 95</li>
<li>[test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to
2.3.0</li>
<li>Bump commons-io:commons-io from 2.20.0 to 2.21.0</li>
<li>Bump commons-lang3 from 3.19.0 to 3.20.0</li>
<li>[test] Bump org.apache.commons:commons-exec from 1.5.0 to
1.6.0</li>
<li>Changes of version 6.11.0</li>
<li>Add Const.MAJOR_25</li>
<li>Add Const.MINOR_25</li>
<li>Add experimental CycloneDX VEX file</li>
<li>Refactor to use new Maven POM variable ecj.version</li>
<li>Replace internal use of Locale.ENGLISH with Locale.ROOT</li>
<li>BCEL-375: Wrong permissions on bcel .jar file in binary
.tar.gz distribution file</li>
<li>BCEL-376: ClassPath.close() throws
UnsupportedOperationException when created with
system-classpath</li>
<li>ClassPath.getResources(String) can use an ArrayList instead of
a Vector</li>
<li>Fix SpotBugs [ERROR] Medium: Operation on the
&quot;created&quot; shared
variable in &quot;ConstantUtf8&quot; class is not atomic [org.apache
.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119]
AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE</li>
<li>Fix SpotBugs [ERROR] Medium: Operation on the
&quot;considered&quot;
shared variable in &quot;ConstantUtf8&quot; class is not atomic [org
.apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:
[line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE</li>
<li>Fix SpotBugs [ERROR] Medium: Operation on the
&quot;skipped&quot; shared
.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134]</li>
<li>org.apache.bcel.util.ClassPath
.addJdkModules(String, List&lt;String&gt;) now reads the system
property &quot;jdk.module.path&quot; instead of
&quot;java.modules.path&quot;</li>
<li>Fix ConstantPoolModuleAccessTest failures on Java 25</li>
<li>377: Fix testing on Java 24 and up</li>
<li>Bump org.apache.commons:commons-parent from 72 to 89</li>
<li>Bump org.apache.commons:commons-lang3 from 3.14.0 to
3.19.0</li>
<li>Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to
2.2.20</li>
<li>Bump commons-io:commons-io from 2.16.1 to 2.20.0</li>
<li>Bump jna.version from 5.14.0 to 5.18.1</li>
<li>Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to
3.2.1</li>
<li>Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to
4.5.0</li>
<li>Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0
a minimum of Java 8</li>
<li>Fix PMD UnnecessaryFullyQualifiedName</li>
<li>Fix PMD EmptyCatchBlock by allowing commented blocks</li>
<li>Fix PMD EmptyControlStatement by allowing commented blocks
JasminVisitor</li>
<li>SpotBugs checks should ignore code generated by JavaCC</li>
<li>Fix SpotBugs URF_UNREAD_FIELD in ClassDumper</li>
<li>Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor
ASTFunAppl
Mini.Environment</li>
<li>Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC</li>
<li>Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[])
TransitiveHull.getIgnored()</li>
<li>Add accessors to model and unit tests, Javadoc</li>
<li>Add Const.MAJOR_22</li>
<li>Add Const.MINOR_22</li>
<li>Add Const.MAJOR_23</li>
<li>Add Const.MINOR_23</li>
<li>Add Const.MAJOR_24</li>
<li>Add Const.MINOR_24
2.0.0
to 4.5.0-M2</li>
<li>Bump org.apache.commons:commons-parent from 69 to 71
3.1.0</li>
<li>Includes changes from 6.9.0 Maintenance and bug fix
release</li>
<li>Add Support for Java 16 records</li>
<li>Add null guard for InstructionFactory.createInvoke()</li>
<li>Avoid possible NullPointerException in
org.apache.bcel.classfile.DescendingVisitor.accept(E[])
AnnotationEntryGen[])
ConstantPoolGen, boolean)
ElementValue[], ConstantPoolGen)
org.apache.bcel.generic.ClassGen.setMethods(Method[])</li>
<li>Avoid possible NullPointerException in org.apache.bcel.generic
.ClassGen.unpackAnnotations(Attribute[])</li>
<li>Avoid possible NullPointerException in org.apache.bcel
.classfile.ParameterAnnotationEntry
.createParameterAnnotationEntries(Attribute[])
org.apache.bcel.generic.ClassGen.ClassGen(JavaClass)
.FieldGenOrMethodGen.addAll(Attribute[])</li>
<li>Avoid NullPointerException after calling org.apache.bcel
.classfile.MethodParameters.setParameters(MethodParameter[])
with null
.classfile.ParameterAnnotations
.setParameterAnnotationTable(ParameterAnnotationEntry[])
.classfile.LocalVariableTypeTable
.setLocalVariableTable(LocalVariable[]) with null
.classfile.LocalVariableTable
.classfile.LineNumberTable.setLineNumberTable(LineNumber[])
.classfile.JavaClass.setMethods(Method[] with null
.classfile.JavaClass.setInterfaces(int[]) with null
.classfile.JavaClass.setInterfaceNames(String[]) with null
.classfile.JavaClass.setFields(Field[]) with null
.classfile.JavaClass.setAttributes(Attribute[]) with null
.classfile.ConstantPool.setConstantPool(Constant[]) with null
.classfile.FieldOrMethod.setAttributes(Attribute[]) with null
.classfile.Annotations.setAnnotationTable(AnnotationEntry[])
.classfile.ArrayElementValue.ArrayElementValue(int,
ElementValue[], ConstantPool) with null
.classfile.BootstrapMethod.BootstrapMethod(int, int[]) with
null
.classfile.BootstrapMethod.setBootstrapArguments(int[]) with
.classfile.BootstrapMethods.BootstrapMethods(int, int,
BootstrapMethod[], ConstantPool) with null
.classfile.BootstrapMethods
.setBootstrapMethods(BootstrapMethod[]) with null</li>
<li>Avoid NullPointerException calling org.apache.bcel.generic
.InstructionList.redirectLocalVariables(LocalVariableGen[],
InstructionHandle, InstructionHandle) with null
.InstructionList.redirectExceptionHandlers(CodeExceptionGen[],
.InstructionList.findHandle(InstructionHandle[], int[], int,
int) with null
.MethodGen.setArgumentTypes(Type[]) with null
.MethodGen.setArgumentNames(String[]) with null
.MethodGen.removeRuntimeAttributes(Attribute[]) with null
.MethodGen.makeMutableVersion(AnnotationEntry[]) with null</li>
<li>Bump org.apache.commons:commons-parent from 66 to 69</li>
<li>Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to
1.9.23</li>
<li>Bump commons-io:commons-io from 2.15.1 to 2.16.1</li>
<li>6.8.0 (2023-12-08) Maintenance and bug fix release
ClassFormatException
input Java4Example
~ Add verifier tests on some opcodes
signatures
~ Add Const.MAJOR_20
~ Add Const.MINOR_20
~ Add Const.MAJOR_21
~ Add Const.MINOR_21
~ [Bcelifier] stackmap support to pass JDK verifier
SE_BAD_FIELD
BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH
NullPointerException
not a NullPointerException
~ Test and coverage of InstructionFactory
~ Verifier: test and coverage for SWAP instruction
() in it`()&#x27;
~ Fix null pointers in AnnotationEntry
supports package-private)
test
ATHROW on empty stack
Select#toString(boolean)
~ Fix EmptyVisitorTestCase on Java 21
~ Bump commons-parent from 54 to 65
~ Bump jna.version from 5.12.1 to 5.13.0
~ Bump kotlin-stdlib from 1.8.10 to 1.9.21
~ Bump commons-io from 2.11.0 to 2.15.1
~ Bump commons-lang3 from 3.12.0 to 3.14.0
3.1.1</li>
<li>6.7.0 (2022-11-28) Maintenance and bug fix release</li>
<li>6.6.1 (2022-10-29) Maintenance and bug fix release</li>
<li>6.6.0 (2022-10-08) Minor feature and bug fix release</li>
<li>6.5.0 (2020-06-05) Minor feature and bug fix release</li>
<li>6.4.1 (2019-09-26) Bug fix release</li>
<li>6.4.0 (2019-09-20) Feature and bug fix release
requires Java 7 or higher to run
class
org.apache.bcel.generic.InstructionConsts class
java.lang.String</li>
</ul>

<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper
patch".<br/>

Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">

<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0

<br/>
<code>zypper in -t patch
SUSE-SLES-16.0-1923</code>

</li>

<li class="list-group-item">
SUSE Linux Enterprise Server 16.0

<br/>
<code>zypper in -t patch
SUSE-SLES-16.0-1923</code>

</li>

</ul>

<h2>Package List:</h2>
<ul>

<li>
SUSE Linux Enterprise Server for SAP applications 16.0
(noarch)
<ul>

<li>bcel-6.13.0-160000.1.1</li>

<li>bcel-javadoc-6.13.0-160000.1.1</li>

</ul>
</li>

<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>

<li>bcel-6.13.0-160000.1.1</li>

<li>bcel-javadoc-6.13.0-160000.1.1</li>

</ul>
</li>

</ul>

<h2>References:</h2>
<ul>

<li>
<a href="https://www.suse.com/security/cve/CVE-2026-105111.html">https://www.suse.com/security/cve/CVE-2026-105111.html</a>
</li>

<li>
<a href="https://www.suse.com/security/cve/CVE-2026-94114.html">https://www.suse.com/security/cve/CVE-2026-94114.html</a>
</li>

<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1284399">https://bugzilla.suse.com/show_bug.cgi?id=1284399</a>
</li>

<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1284400">https://bugzilla.suse.com/show_bug.cgi?id=1284400</a>
</li>

</ul>

</div>

--===============7446652816113714015==--