CVE-2026-110259
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()
- State
- Published
- Severity
- 6.8 Medium
- Published
- Oct 14, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 13, 2026
Description
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-674 Uncontrolled Recursion
Affected Products
| Product | Versions |
|---|---|
ASMOW2 |
|
References
- https://gitlab.ow2.org/asm/asm/-/merge_requests/459patch
- https://gitlab.ow2.org/asm/asm/-/commit/e9aca627c17e1619bcb8059afb43382dac6b275fpatch
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/ClassWriter.java#L751technical-description
- ASM 9.11 Release Notesrelease-notes
- VulnCheck Advisory: OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.