CVE-2026-110263

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110263
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110263.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110263
Downstream
AZL (2)
DEBIAN (1)
RHSA (1)
UBUNTU (1)
Published
2026-10-14T14:16:34Z
Modified
2026-10-28T02:31:13Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
Details

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110263.json"
}
References

Affected packages

Git / gitlab.ow2.org/asm/asm

Affected ranges

Type
GIT
Repo
https://gitlab.ow2.org/asm/asm
Events
Introduced
27979790f50bb16044d19a68754931c9093071d0
Fixed
baeba2ca4e5f8196795340b015ca8b69f39740f5
Fixed
8f87fc0317a4c5ee8f538bcbb641928def25dbd6
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.0"
                },
                {
                    "fixed": "9.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "8f87fc0317a4c5ee8f538bcbb641928def25dbd6"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
ASM_3_0
ASM_3_1
ASM_3_3
ASM_3_3_1
ASM_3_3_2
ASM_4_0
ASM_4_0_RC1
ASM_4_0_RC2
ASM_4_1
ASM_4_2
ASM_5_0
ASM_5_0_1
ASM_5_0_2
ASM_5_0_3
ASM_5_0_4
ASM_5_0_BETA
ASM_5_1
ASM_5_2
ASM_6_0
ASM_6_0_BETA
ASM_6_1
ASM_6_1_1
ASM_6_1_BETA
ASM_6_1_BETA2
ASM_6_2
ASM_6_2_1
ASM_7_0
ASM_7_0_BETA
ASM_7_1
ASM_7_2
ASM_7_2_BETA
ASM_7_3_1
ASM_8_0
ASM_8_0_1
ASM_9_0
ASM_9_0_BETA
ASM_9_1
ASM_9_10
ASM_9_10_1
ASM_9_2
ASM_9_3
ASM_9_4
ASM_9_5
ASM_9_6
ASM_9_7
ASM_9_7_1
ASM_9_8
ASM_9_9
ASM_9_9_1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110263.json"