Uncontrolled Recursion Vulnerability in OW2 ASM by OW2
CVE-2026-110263

6.8MEDIUM

Key Information:

Vendor

Ow2

Status
Asm
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110263?

A vulnerability exists in OW2 ASM versions prior to 9.11, where the SignatureReader.parseType() function is susceptible to uncontrolled recursion. Attackers can exploit this flaw by supplying a crafted class file featuring a lengthy Signature attribute with multiple nested type arguments. This can lead to a StackOverflowError during class transformation, ultimately causing a denial of service as the system becomes unresponsive due to stack exhaustion.

Affected Version(s)

ASM 3.0 < 9.11

References

https://gitlab.ow2.org/asm/asm/-/merge_requests/465
patch
https://gitlab.ow2.org/asm/asm/-/commit/8f87fc0317a4c5ee8...
patch
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric Bruneton
.