Uncontrolled Memory Allocation in OW2 ASM Product by OW2

CVE-2026-110270

What is CVE-2026-110270?

OW2 ASM versions prior to 9.11 contain a vulnerability in the asm-commons JSRInlinerAdapter, which inadvertently allows for uncontrolled memory allocation. When an attacker supplies a specially crafted class file that includes nested subroutines, the application may trigger an exponential increase in memory allocation (O(2^n)). This can result in an OutOfMemoryError, potentially crashing the Java Virtual Machine (JVM) and rendering the application unavailable. It is crucial for users of affected versions to apply the appropriate patches to mitigate this risk.

References