Excessive Memory Allocation Vulnerability in OW2 ASM by OW2
CVE-2026-110258

6.8MEDIUM

Key Information:

Vendor

Ow2

Status
Asm
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110258?

The OW2 ASM framework versions prior to 9.11 exhibit a vulnerability wherein the method Label.addSubroutineRetSuccessors() permits excessive memory allocation. By using a specially crafted class file that includes multiple RET instructions associated with a single JSR operation, an attacker can induce the Java Virtual Machine (JVM) to allocate approximately 2 GB of memory, potentially leading to a crash. This vulnerability underscores the importance of thoroughly validating class structure to maintain system integrity and reliability.

Affected Version(s)

ASM 3.0 < 9.11

References

https://gitlab.ow2.org/asm/asm/-/merge_requests/458
patch
https://gitlab.ow2.org/asm/asm/-/commit/4dabfe0aef14f8ccc...
patch
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric Bruneton
.