Uncontrolled Recursion Vulnerability in OW2 ASM Affecting ClassWriter Module

CVE-2026-110259

What is CVE-2026-110259?

The OW2 ASM library versions prior to 9.11 are susceptible to an uncontrolled recursion vulnerability within the ClassWriter.replaceAsmInstructions() method. This flaw can be exploited by attackers who craft class files featuring methods that contain numerous lengthy forward jumps. When such a method is processed, it leads to unbounded recursion during the invocation of toByteArray(), ultimately causing a StackOverflowError and resulting in a denial of service. Users of OW2 ASM should ensure that they are running the latest patched version to protect against this vulnerability.

References