Apache Commons BCEL vulnerable to out-of-bounds writeGHSA-97xg-phpr-rg8q
CRITICALFix: apache/commons-bcel#147GHSA-97xg-phpr-rg8q is a critical-severity (CVSS 9.8) Out-of-bounds Write vulnerability in org.apache.bcel:bcel. A fix is available for org.apache.bcel:bcel — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
org.apache.bcel:bcelReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.apache.bcel:bcel | all versions | 6.6.0org.apache.bcel:bcel:6.6.0 |
Affected Products
commons bcelapachefedorafedoraprojectDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.bcel:bcel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.apache.bcel:bcel to 6.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-97xg-phpr-rg8q is resolved across your whole dependency graph.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Fuse 7 ships the code in question but does not utilize it in the product, so it is affected at a reduced impact of Moderate.
| Product | Fixed in | Advisory |
|---|---|---|
| Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-operator-bundle:1.0-30 | RHSA-2023:0470 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | org.jboss.windup-windup-parent | RHSA-2023:0471 |
| MTA-6.0-RHEL-8 | mta/mta-ui-rhel8:6.0.1-10 | RHSA-2023:0934 |
| Red Hat AMQ Streams 2.7.0 | see advisory | RHSA-2024:3527 |
| Red Hat Enterprise Linux 7 | bcel-0:5.2-19.el7_9 | RHSA-2022:8958 |
| Red Hat Enterprise Linux 9 | bcel-0:6.4.1-9.el9_1 | RHSA-2023:0005 |
| Red Hat Enterprise Linux 9.0 Extended Update Support | bcel-0:6.4.1-9.el9_0 | RHSA-2023:0004 |
| Red Hat Fuse 7.12 | apache-bcel | RHSA-2023:3954 |
Frequently Asked Questions
Is GHSA-97xg-phpr-rg8q in your dependencies?
Find it across Maven, including transitive dependencies.