CVE-2026-110263
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
- State
- Published
- Severity
- 6.8 Medium
- Published
- Oct 14, 2026
- Updated
- Oct 14, 2026
- Reserved
- Oct 13, 2026
Description
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-674 Uncontrolled Recursion
Affected Products
| Product | Versions |
|---|---|
ASMOW2 |
|
References
- https://gitlab.ow2.org/asm/asm/-/merge_requests/465patch
- https://gitlab.ow2.org/asm/asm/-/commit/8f87fc0317a4c5ee8f538bcbb641928def25dbd6patch
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/signature/SignatureReader.java#L151technical-description
- ASM 9.11 Release Notesrelease-notes
- VulnCheck Advisory: OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReaderthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.