Quadratic Memory Allocation Vulnerability in OW2 ASM by OW2
CVE-2026-110260

6.8MEDIUM

Key Information:

Vendor

Ow2

Status
Asm
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110260?

A vulnerability in OW2 ASM versions prior to 9.11 allows attackers to exploit the MethodWriter.computeMaxStackAndLocal() and computeAllFrames() methods by supplying a specially crafted class file. This class file can contain a vast number of overlapping exception handlers, resulting in excessive memory allocations. Consequently, this can trigger an OutOfMemoryError, leading to a crash of the Java Virtual Machine (JVM), which poses significant risk to applications relying on this framework.

Affected Version(s)

ASM 3.0 < 9.11

References

https://gitlab.ow2.org/asm/asm/-/merge_requests/461
patch
https://gitlab.ow2.org/asm/asm/-/commit/91057c98239d994ae...
patch
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu Bao, PayPal Cyber Security Team
.