CVE-2026-110259

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-110259

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110259.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-110259

Published

2026-10-14T14:16:32Z

Modified

2026-10-15T02:47:47Z

Severity

6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()

Details

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-674"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110259.json"
}

References

Affected packages

Git / gitlab.ow2.org/asm/asm

Affected ranges

Type

GIT

Repo

https://gitlab.ow2.org/asm/asm

Events

Introduced

27979790f50bb16044d19a68754931c9093071d0

Fixed

baeba2ca4e5f8196795340b015ca8b69f39740f5

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "3.0"
        },
        {
            "fixed":  "9.11"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other

ASM_3_0

ASM_3_1

ASM_3_3

ASM_3_3_1

ASM_3_3_2

ASM_4_0

ASM_4_0_RC1

ASM_4_0_RC2

ASM_4_1

ASM_4_2

ASM_5_0

ASM_5_0_1

ASM_5_0_2

ASM_5_0_3

ASM_5_0_4

ASM_5_0_BETA

ASM_5_1

ASM_5_2

ASM_6_0

ASM_6_0_BETA

ASM_6_1

ASM_6_1_1

ASM_6_1_BETA

ASM_6_1_BETA2

ASM_6_2

ASM_6_2_1

ASM_7_0

ASM_7_0_BETA

ASM_7_1

ASM_7_2

ASM_7_2_BETA

ASM_7_3_1

ASM_8_0

ASM_8_0_1

ASM_9_0

ASM_9_0_BETA

ASM_9_1

ASM_9_10

ASM_9_10_1

ASM_9_2

ASM_9_3

ASM_9_4

ASM_9_5

ASM_9_6

ASM_9_7

ASM_9_7_1

ASM_9_8

ASM_9_9

ASM_9_9_1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110259.json"