CVE-2026-110270: Inefficient Algorithmic Complexity in OW2 ASM
Description
CVE-2026-110270 is a vulnerability in OW2 ASM versions 3.0 up to but not including 9.11. It involves an uncontrolled memory allocation in the asm-commons JSRInlinerAdapter component that inlines JSR/RET subroutines without limits. Crafted class files with nested subroutines can cause exponential memory allocation, leading to an OutOfMemoryError and JVM crash.
CVSS v4.0
Score 6.8medium
Affected software
OW2
ASM
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects OW2 ASM, a Java bytecode manipulation framework, specifically in the asm-commons JSRInlinerAdapter. The flaw allows attackers to supply specially crafted class files containing nested JSR/RET subroutines that trigger an algorithmic complexity issue, causing memory allocation to grow exponentially (O(2^n)). This results in an OutOfMemoryError that crashes the Java Virtual Machine (JVM). The affected versions are from 3.0 up to but excluding 9.11.
Potential Impact
Exploitation of this vulnerability can cause denial of service by crashing the JVM due to an OutOfMemoryError. This impacts availability of applications or services relying on the vulnerable ASM library for bytecode manipulation. There is no indication of privilege escalation or code execution from this vulnerability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or malicious class files with nested JSR/RET subroutines using the affected ASM versions. Monitor vendor communications for updates on patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-13T18:55:57.281Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acf92e72cdf04f6568a2408
Added to database: 10/14/2026, 14:34:15 UTC
Last enriched: 10/14/2026, 15:19:14 UTC
Last updated: 10/14/2026, 19:00:33 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.