Amazon Linux 2023 Security Advisory: ALAS2023-2026-3422
Advisory Released Date: 2026-11-12
Advisory Updated Date: 2026-11-12
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.
This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).
This issue affects Apache Commons BCEL: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue. (CVE-2026-105111)
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue. (CVE-2026-94114)
Affected Packages:
bcel
Issue Correction:
Run dnf update bcel --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3422 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
noarch:
bcel-6.13.0-1.amzn2023.0.1.noarch
src:
bcel-6.13.0-1.amzn2023.0.1.src