The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22109-1 advisory.

    - CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser     (bsc#1284400).
    - CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399).

    Changes for bcel:

    - Update to version 6.13.0
     * New Features      + Add support for permitted subclasses      + Add RecordComponentInfo.getAttribute(byte tag)      + Add Const.MAJOR_27      + Add Const.MINOR_27      + Add and use ArrayType.isElementType(Type)      + Add Const.MAJOR_28      + Add Const.MINOR_28
     * Fixed Bugs      + Fix constant pool module access test on Java 26 and above      + Deprecate org.apache.bcel.classfile.Utility.Utility()      + Deprecate org.apache.bcel.verifier.exc.Utility      .getStackTrace(Throwable)      + Fix all Javadoc warnings and enforce checks by default      + Escape constant pool names in generated HTML      + Escape referenced names in BCELFactory Java output      + Make wide flag thread-local in Utility.codeToString      + Read multianewarray dimensions as unsigned byte      + Site docs: clarify security model      + Read ConstantDynamic indices as unsigned shorts      + Validate index upper bound in CPInstruction, IINC and RET      setIndex      + Use correct attribute tag in NestHost and ModuleMainClass      + Propagate runtime-visible flag when parsing parameter      annotations      + Use fixedLength for parsed LOOKUPSWITCH length      + Fix ConstantPoolGen dedup key collisions for names with      delimiters      + Read unsigned bytecode operands in CodeHTML disassembler      + Deep-copy bootstrap arguments array in BootstrapMethod.copy()      + Use exclusive live-range end in LocalVariableTable      .getLocalVariable      + Build TABLESWITCH from sorted arrays in SWITCH      + Use array element type not basic type for primitive array      access      + Set length in INVOKEDYNAMIC constructor      + Reject CALOAD on non-char arrays in structural verification      + Add negative verifier tests for remaining array load/store      component type checks      + Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY      + Match wide local variable instruction length to dumped bytes      + Bound IINC increment to signed short      + Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8      + Nested Code/Record attributes drive unbounded parse-time      recursion in ClassParser      + Nested annotation element values recurse unboundedly;
     MAX_ARRAY_DIMENSIONS cap bypassed      + Opcodes tableswitch and lookupswitch add boundary checks      + JustIce Pass 2 hangs on cyclic superclass chain of a      referenced exception class      + JustIce Pass 2 LVT check amplifies each 10-byte entry into      ~131k hashtable operations      + Pass 3b dataflow stores frames per instruction and clones      ever-growing execution chains      + Cubic handlers * range * subroutines scan in Subroutines      constructor hangs JustIce Pass 3b      + Subroutines.noRecursiveCalls enumerates exponentially many JSR      call paths      + Disassembler and Class2HTML re-implement the unchecked      switch-table allocation      + ConstantPool.constantToString recurses forever on      self-referencing CONSTANT_MethodHandle      + Utility.typeSignatureToString recurses per generic-nesting      level, unbounded, with quadratic substring copies      + Repositories cache classes under the input-defined this_class      name; global static Repository/VerifierFactory make the      poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114)      + Silent u2/u1 count truncation across dump paths corrupts      emitted bytecode      + Class2HTML emitters write attacker class-file strings into      HTML unescaped (stored XSS in reports) (bsc#1284399,      CVE-2026-105111)      + Class2HTML builds output file paths from the unvalidated class      name      + ClassPath.getBytes() sizes its buffer from the forged ZIP      uncompressed-size field      + PMG attribute ignores declared length, enabling BCEL-vs-JVM      parse divergence      + Signature.matchGJIdent recurses unboundedly on nested generic      signatures (Signature.translate)      + Utility.decode fixed 3x buffer breaks the encode/decode round      trip and throws unchecked AIOOBE      + BCELifier interpolates attacker class/package names into      generated Java source unescaped      + Verifier pass 3a delayed checks are quadratic in attribute and      code size      + Verifier cache grows unboundedly with attacker-chosen class      names      + Static WIDE ThreadLocal survives exceptions, corrupting the      next class's disassembly on the same thread      + Utility.JavaReader escape decoding: OOB table index, bad-hex      crash, silent non-canonical aliasing
     * Changes      + Bump org.apache.commons:commons-parent from 95 to 104      + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20      + Bump commons-io:commons-io from 2.21.0 to 2.22.0      + Bump jna.version from 5.18.1 to 5.19.1      + [test] Bump org.apache.commons:commons-collections4 from 4.5.0      to 4.6.0
    - Changes of version 6.12.0      + Add Const.MAJOR_26      + Add Const.MINOR_26      + Fix infinite loop in example.TransitiveHull      + Fix Apache RAT plugin console warnings      + Fix malformed Javadoc comments      + Make the build reproducible on the Azul JDK      + Fix infinite loop in JavaClass.findField() on invalid input      + Fix infinite loop in JavaClass.getAllInterfaces() on invalid      input      + Fix infinite loop in JavaClass.getSuperClasses() on invalid      + Exception message in Args.requireU4() refers to the wrong data      type      + Exception message in Args.requireU2() refers to the wrong      upper range value      + Code.Code(int, int, DataInput, ConstantPool) now throws a      ClassFormatException if the code array is greater than the      JVM specification allows      + Code.Code(int, int, int, int, byte[], CodeException[],      Attribute[], ConstantPool) now throws a ClassFormatException      if the code array is greater than the JVM specification allows      + Code.setCode(byte[]) now throws a ClassFormatException if the      code array is greater than the JVM specification allows      + ClassDumper.dump() should not call the input stream it didn't      open; fixes IOException when calling DumpClass.main      (ClassDumper.java:351)      + org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[])      now uses varagrs: ConstantPool(Constant...)      + org.apache.bcel.classfile.Deprecated now requires its the      attribute_length item be zero      + org.apache.bcel.classfile.Synthetic now requires its the      + The size of an Attribute unknown to the JVM specification is      limited to 1 MB and is overridden with the system property      BCEL.Attribute.Unknown.max_attribute_length      + Bump org.apache.commons:commons-parent from 89 to 95      + [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to      2.3.0      + Bump commons-io:commons-io from 2.20.0 to 2.21.0      + Bump commons-lang3 from 3.19.0 to 3.20.0      + [test] Bump org.apache.commons:commons-exec from 1.5.0 to      1.6.0
    - Changes of version 6.11.0      + Add Const.MAJOR_25      + Add Const.MINOR_25      + Add experimental CycloneDX VEX file      + Refactor to use new Maven POM variable ecj.version      + Replace internal use of Locale.ENGLISH with Locale.ROOT      + BCEL-375: Wrong permissions on bcel .jar file in binary      .tar.gz distribution file      + BCEL-376: ClassPath.close() throws      UnsupportedOperationException when created with      system-classpath      + ClassPath.getResources(String) can use an ArrayList instead of      a Vector      + Fix SpotBugs [ERROR] Medium: Operation on the created shared      variable in ConstantUtf8 class is not atomic [org.apache      .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119]      AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE      + Fix SpotBugs [ERROR] Medium: Operation on the considered      shared variable in ConstantUtf8 class is not atomic [org      .apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:
     [line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE      + Fix SpotBugs [ERROR] Medium: Operation on the skipped shared      .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134]      + org.apache.bcel.util.ClassPath      .addJdkModules(String, List<String>) now reads the system      property jdk.module.path instead of java.modules.path      + Fix ConstantPoolModuleAccessTest failures on Java 25      + 377: Fix testing on Java 24 and up      + Bump org.apache.commons:commons-parent from 72 to 89      + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0      + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20      + Bump commons-io:commons-io from 2.16.1 to 2.20.0      + Bump jna.version from 5.14.0 to 5.18.1      + Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to      3.2.1      + Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to      4.5.0      + Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0      a minimum of Java 8      + Fix PMD UnnecessaryFullyQualifiedName      + Fix PMD EmptyCatchBlock by allowing commented blocks      + Fix PMD EmptyControlStatement by allowing commented blocks      JasminVisitor      + SpotBugs checks should ignore code generated by JavaCC      + Fix SpotBugs URF_UNREAD_FIELD in ClassDumper      + Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor      ASTFunAppl      Mini.Environment      + Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC      + Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[])      TransitiveHull.getIgnored()      + Add accessors to model and unit tests, Javadoc      + Add Const.MAJOR_22      + Add Const.MINOR_22      + Add Const.MAJOR_23      + Add Const.MINOR_23      + Add Const.MAJOR_24      + Add Const.MINOR_24      2.0.0      to 4.5.0-M2      + Bump org.apache.commons:commons-parent from 69 to 71      3.1.0
     * Includes changes from 6.9.0 Maintenance and bug fix release      + Add Support for Java 16 records      + Add null guard for InstructionFactory.createInvoke()      + Avoid possible NullPointerException in      org.apache.bcel.classfile.DescendingVisitor.accept(E[])      AnnotationEntryGen[])      ConstantPoolGen, boolean)      ElementValue[], ConstantPoolGen)      org.apache.bcel.generic.ClassGen.setMethods(Method[])      + Avoid possible NullPointerException in org.apache.bcel.generic      .ClassGen.unpackAnnotations(Attribute[])      + Avoid possible NullPointerException in org.apache.bcel      .classfile.ParameterAnnotationEntry      .createParameterAnnotationEntries(Attribute[])      org.apache.bcel.generic.ClassGen.ClassGen(JavaClass)      .FieldGenOrMethodGen.addAll(Attribute[])      + Avoid NullPointerException after calling org.apache.bcel      .classfile.MethodParameters.setParameters(MethodParameter[])      with null      .classfile.ParameterAnnotations      .setParameterAnnotationTable(ParameterAnnotationEntry[])      .classfile.LocalVariableTypeTable      .setLocalVariableTable(LocalVariable[]) with null      .classfile.LocalVariableTable      .classfile.LineNumberTable.setLineNumberTable(LineNumber[])      .classfile.JavaClass.setMethods(Method[] with null      .classfile.JavaClass.setInterfaces(int[]) with null      .classfile.JavaClass.setInterfaceNames(String[]) with null      .classfile.JavaClass.setFields(Field[]) with null      .classfile.JavaClass.setAttributes(Attribute[]) with null      .classfile.ConstantPool.setConstantPool(Constant[]) with null      .classfile.FieldOrMethod.setAttributes(Attribute[]) with null      .classfile.Annotations.setAnnotationTable(AnnotationEntry[])      .classfile.ArrayElementValue.ArrayElementValue(int,      ElementValue[], ConstantPool) with null      .classfile.BootstrapMethod.BootstrapMethod(int, int[]) with      null      .classfile.BootstrapMethod.setBootstrapArguments(int[]) with      .classfile.BootstrapMethods.BootstrapMethods(int, int,      BootstrapMethod[], ConstantPool) with null      .classfile.BootstrapMethods      .setBootstrapMethods(BootstrapMethod[]) with null      + Avoid NullPointerException calling org.apache.bcel.generic      .InstructionList.redirectLocalVariables(LocalVariableGen[],      InstructionHandle, InstructionHandle) with null      .InstructionList.redirectExceptionHandlers(CodeExceptionGen[],      .InstructionList.findHandle(InstructionHandle[], int[], int,      int) with null      .MethodGen.setArgumentTypes(Type[]) with null      .MethodGen.setArgumentNames(String[]) with null      .MethodGen.removeRuntimeAttributes(Attribute[]) with null      .MethodGen.makeMutableVersion(AnnotationEntry[]) with null      + Bump org.apache.commons:commons-parent from 66 to 69      + Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23      + Bump commons-io:commons-io from 2.15.1 to 2.16.1
     * 6.8.0 (2023-12-08) Maintenance and bug fix release      ClassFormatException      input Java4Example      ~ Add verifier tests on some opcodes      signatures      ~ Add Const.MAJOR_20      ~ Add Const.MINOR_20      ~ Add Const.MAJOR_21      ~ Add Const.MINOR_21      ~ [Bcelifier] stackmap support to pass JDK verifier      SE_BAD_FIELD      BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH      NullPointerException      not a NullPointerException      ~ Test and coverage of InstructionFactory      ~ Verifier: test and coverage for SWAP instruction      () in it`()'      ~ Fix null pointers in AnnotationEntry      supports package-private)      test      ATHROW on empty stack      Select#toString(boolean)      ~ Fix EmptyVisitorTestCase on Java 21      ~ Bump commons-parent from 54 to 65      ~ Bump jna.version from 5.12.1 to 5.13.0      ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21      ~ Bump commons-io from 2.11.0 to 2.15.1      ~ Bump commons-lang3 from 3.12.0 to 3.14.0      3.1.1
     * 6.7.0 (2022-11-28) Maintenance and bug fix release
     * 6.6.1 (2022-10-29) Maintenance and bug fix release
     * 6.6.0 (2022-10-08) Minor feature and bug fix release
     * 6.5.0 (2020-06-05) Minor feature and bug fix release
     * 6.4.1 (2019-09-26) Bug fix release
     * 6.4.0 (2019-09-20) Feature and bug fix release      requires Java 7 or higher to run      class      org.apache.bcel.generic.InstructionConsts class      java.lang.String

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

openSUSE 16 Security Update : bcel (openSUSE-SU-2026:22109-1)

high Nessus Plugin ID 367232

Version 1.1