CVE-2026-110262

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-110262

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110262.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-110262

Published

2026-10-14T14:16:34Z

Modified

2026-10-15T02:47:47Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter

Details

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in forwardJumpStackFrames and allocation of hundreds of megabytes, leading to denial of service.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110262.json"
}

References

Affected packages

Git / gitlab.ow2.org/asm/asm

Affected ranges

Type

GIT

Repo

https://gitlab.ow2.org/asm/asm

Events

Introduced

c7fb397ffdf8016777a11044230fa1f706e2ac04

Fixed

baeba2ca4e5f8196795340b015ca8b69f39740f5

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "3.1"
        },
        {
            "fixed":  "9.11"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other

ASM_3_1

ASM_3_3

ASM_3_3_1

ASM_3_3_2

ASM_4_0

ASM_4_0_RC1

ASM_4_0_RC2

ASM_4_1

ASM_4_2

ASM_5_0

ASM_5_0_1

ASM_5_0_2

ASM_5_0_3

ASM_5_0_4

ASM_5_0_BETA

ASM_5_1

ASM_5_2

ASM_6_0

ASM_6_0_BETA

ASM_6_1

ASM_6_1_1

ASM_6_1_BETA

ASM_6_1_BETA2

ASM_6_2

ASM_6_2_1

ASM_7_0

ASM_7_0_BETA

ASM_7_1

ASM_7_2

ASM_7_2_BETA

ASM_7_3_1

ASM_8_0

ASM_8_0_1

ASM_9_0

ASM_9_0_BETA

ASM_9_1

ASM_9_10

ASM_9_10_1

ASM_9_2

ASM_9_3

ASM_9_4

ASM_9_5

ASM_9_6

ASM_9_7

ASM_9_7_1

ASM_9_8

ASM_9_9

ASM_9_9_1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110262.json"