Threat Intelligence Database

CVE-2026-110591 is a medium severity vulnerability in OW2 ASM versions 1.4.3 up to but not including 9.11. It involves excessive resource consumption in the Analyzer.analyze() method, where attackers can supply crafted class files to cause unbounded memory and CPU usage. This leads to denial of service by exhausting system resources during class file analysis.

CVE-2026-110270 is a vulnerability in OW2 ASM versions 3.0 up to but not including 9.11. It involves an uncontrolled memory allocation in the asm-commons JSRInlinerAdapter component that inlines JSR/RET subroutines without limits. Crafted class files with nested subroutines can cause exponential memory allocation, leading to an OutOfMemoryError and JVM crash.

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in forwardJumpStackFrames and allocation of hundreds of megabytes, leading to denial of service.

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algorithm converge slowly, tying up transforming threads for unbounded time.

CVE-2026-110260 is a vulnerability in OW2 ASM versions 3.0 up to but not including 9.11. It involves a quadratic memory allocation issue in the MethodWriter class when using COMPUTE_MAXS or COMPUTE_FRAMES. An attacker can craft a class file with many overlapping exception handlers, causing excessive memory allocation and potentially crashing the JVM with an OutOfMemoryError.

CVE-2026-110259 is a vulnerability in OW2 ASM versions 3.0 up to but not including 9.11. It involves uncontrolled recursion in the ClassWriter.replaceAsmInstructions() method, which can be triggered by crafted class files containing large methods with many long forward jumps. This causes unbounded recursion in toByteArray(), leading to a StackOverflowError and denial of service.

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation that crashes the JVM.

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB allocation, causing an OutOfMemoryError that crashes the JVM or consuming thread.