Excessive Memory Allocation Vulnerability in OW2 ASM Product by OW2
CVE-2026-110262

4.8MEDIUM

Key Information:

Vendor

Ow2

Status
Asm
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110262?

The OW2 ASM library prior to version 9.11 contains a critical vulnerability in the asm-commons AdviceAdapter. This flaw allows attackers to send specially crafted class files that can result in excessive memory allocation. By crafting bytecode with numerous forward jump targets in constructors, attackers may trigger unbounded stack copy operations in forwardJumpStackFrames, consuming significant memory resources and potentially leading to denial of service conditions.

Affected Version(s)

ASM 3.1 < 9.11

References

https://gitlab.ow2.org/asm/asm/-/merge_requests/464
patch
https://gitlab.ow2.org/asm/asm/-/commit/b7e6c88801790c9da...
patch
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-comm...
technical-description

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric Bruneton
.