CVE-2026-94114 Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser

Symbolic name not mapping to correct object vulnerability in Apache Commons. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue...