CVE-2026-110257

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110257
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110257.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110257
Downstream
AZL (2)
DEBIAN (1)
RHSA (1)
UBUNTU (1)
Published
2026-10-14T14:16:30Z
Modified
2026-10-28T02:30:25Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute
Details

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB allocation, causing an OutOfMemoryError that crashes the JVM or consuming thread.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110257.json"
}
References

Affected packages

Git / gitlab.ow2.org/asm/asm

Affected ranges

Type
GIT
Repo
https://gitlab.ow2.org/asm/asm
Events
Introduced
46a460a9dcb826f12d6663ccb18fcad876cb492a
Fixed
baeba2ca4e5f8196795340b015ca8b69f39740f5
Fixed
eb5fa95bb0670eaec2ecf9b8a3a501b48e5a967c
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "5.0"
                },
                {
                    "fixed": "9.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "eb5fa95bb0670eaec2ecf9b8a3a501b48e5a967c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
ASM_5_0
ASM_5_0_1
ASM_5_0_2
ASM_5_0_3
ASM_5_0_4
ASM_5_1
ASM_5_2
ASM_6_0
ASM_6_0_BETA
ASM_6_1
ASM_6_1_1
ASM_6_1_BETA
ASM_6_1_BETA2
ASM_6_2
ASM_6_2_1
ASM_7_0
ASM_7_0_BETA
ASM_7_1
ASM_7_2
ASM_7_2_BETA
ASM_7_3_1
ASM_8_0
ASM_8_0_1
ASM_9_0
ASM_9_0_BETA
ASM_9_1
ASM_9_10
ASM_9_10_1
ASM_9_2
ASM_9_3
ASM_9_4
ASM_9_5
ASM_9_6
ASM_9_7
ASM_9_7_1
ASM_9_8
ASM_9_9
ASM_9_9_1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110257.json"