CVE-2026-110259

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110259
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110259.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110259
Downstream
AZL (2)
DEBIAN (1)
UBUNTU (1)
Published
2026-10-14T14:16:32Z
Modified
2026-10-28T02:30:55Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()
Details

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110259.json"
}
References

Affected packages

Git / gitlab.ow2.org/asm/asm

Affected ranges

Type
GIT
Repo
https://gitlab.ow2.org/asm/asm
Events
Introduced
27979790f50bb16044d19a68754931c9093071d0
Fixed
baeba2ca4e5f8196795340b015ca8b69f39740f5
Fixed
e9aca627c17e1619bcb8059afb43382dac6b275f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.0"
                },
                {
                    "fixed": "9.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "e9aca627c17e1619bcb8059afb43382dac6b275f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
ASM_3_0
ASM_3_1
ASM_3_3
ASM_3_3_1
ASM_3_3_2
ASM_4_0
ASM_4_0_RC1
ASM_4_0_RC2
ASM_4_1
ASM_4_2
ASM_5_0
ASM_5_0_1
ASM_5_0_2
ASM_5_0_3
ASM_5_0_4
ASM_5_0_BETA
ASM_5_1
ASM_5_2
ASM_6_0
ASM_6_0_BETA
ASM_6_1
ASM_6_1_1
ASM_6_1_BETA
ASM_6_1_BETA2
ASM_6_2
ASM_6_2_1
ASM_7_0
ASM_7_0_BETA
ASM_7_1
ASM_7_2
ASM_7_2_BETA
ASM_7_3_1
ASM_8_0
ASM_8_0_1
ASM_9_0
ASM_9_0_BETA
ASM_9_1
ASM_9_10
ASM_9_10_1
ASM_9_2
ASM_9_3
ASM_9_4
ASM_9_5
ASM_9_6
ASM_9_7
ASM_9_7_1
ASM_9_8
ASM_9_9
ASM_9_9_1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110259.json"