Excessive Memory Allocation Vulnerability in OW2 ASM by OW2
CVE-2026-110257

6.8MEDIUM

Key Information:

Vendor

Ow2

Status
Asm
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110257?

OW2 ASM versions prior to 9.11 are susceptible to an excessive memory allocation issue within the ClassReader.readBootstrapMethodsAttribute() method. This vulnerability arises when the method attempts to size an integer array based on the num_bootstrap_methods parameter without properly validating the attribute_length. An attacker can exploit this by sending a specially crafted class file, leading to a massive memory allocation request of about 2 GB. This scenario could result in an OutOfMemoryError, potentially crashing the Java Virtual Machine (JVM) or affecting the stability of the consuming thread.

Affected Version(s)

ASM 5.0 < 9.11

References

https://gitlab.ow2.org/asm/asm/-/merge_requests/456
patch
https://gitlab.ow2.org/asm/asm/-/commit/eb5fa95bb0670eaec...
patch
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu Bao, PayPal Cyber Security Team
.