CVE-2026-110263: Uncontrolled Recursion in OW2 ASM

The vulnerability exists in OW2 ASM, a Java bytecode manipulation framework, specifically in the SignatureReader.parseType() method. When processing a class file with a Signature attribute containing many nested generic type arguments, the method performs uncontrolled recursion that can exhaust the stack. This leads to a StackOverflowError and causes the affected process to crash or hang, resulting in denial of service. The issue affects versions from 3.0 up to but not including 9.11.

An attacker can supply a maliciously crafted class file with a deeply nested generic type signature to trigger a stack overflow during class transformation. This results in a denial of service by crashing or hanging the application using the vulnerable ASM library. There is no indication of privilege escalation, code execution, or information disclosure from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted class files with deeply nested generic type signatures using affected versions of OW2 ASM. Monitor vendor channels for updates regarding patches or official mitigations.