Threat database

OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.

OW2 ASM versions from 1.4.3 up to but not including 9.11 contain a vulnerability in the Analyzer.analyze() function that allows attackers to cause excessive resource consumption. By supplying crafted class files analyzed through BasicVerifier, SimpleVerifier, or SourceInterpreter, attackers can trigger unbounded allocation of Frames and fix point iterations, leading to denial of service due to memory and CPU exhaustion.

CVE-2026-110270 is a medium severity vulnerability in OW2 ASM affecting versions 3.0 up to but not including 9.11. It involves an inefficient algorithmic complexity in the asm-commons JSRInlinerAdapter component, which inlines JSR/RET subroutines without limits. Crafted class files with nested subroutines can cause exponential memory allocation, leading to OutOfMemoryError and JVM crashes.

CVE-2026-110263 is a vulnerability in OW2 ASM versions 3.0 up to but not including 9.11. It involves uncontrolled recursion in the SignatureReader.parseType() method, which can be triggered by a crafted class file containing deeply nested generic type signatures. This causes a StackOverflowError during class transformation, resulting in a denial of service condition.

CVE-2026-110262 is a medium severity vulnerability in OW2 ASM affecting versions from 3.1 up to but not including 9.11. It involves excessive memory allocation in the asm-commons AdviceAdapter component, where crafted class files with many forward jump targets in constructors cause unbounded stack copies and large memory consumption, leading to denial of service.

OW2 ASM versions 3.0 up to but not including 9.11 contain a denial of service vulnerability due to inefficient algorithmic complexity in the ClassWriter.COMPUTE_FRAMES processing. Crafted class files can cause the MethodWriter.computeAllFrames() algorithm to converge very slowly, leading to CPU exhaustion and tying up threads indefinitely.

CVE-2026-110260 is a vulnerability in OW2 ASM versions 3.0 up to but not including 9.11. It involves a quadratic memory allocation issue in the MethodWriter.computeMaxStackAndLocal() and computeAllFrames() methods when using COMPUTE_MAXS or COMPUTE_FRAMES. An attacker can craft a class file with thousands of overlapping exception handlers, causing excessive memory allocation leading to an OutOfMemoryError and JVM crash.

CVE-2026-110259 is a medium severity vulnerability in OW2 ASM affecting versions 3.0 up to but not including 9.11. It involves uncontrolled recursion in the ClassWriter.replaceAsmInstructions() method triggered by crafted class files with large methods containing many long forward jumps. This leads to unbounded recursion in the toByteArray() method, causing a StackOverflowError and denial of service.

CVE-2026-110258 is a vulnerability in OW2 ASM versions 3.0 up to but not including 9.11. It involves excessive memory allocation in the method Label.addSubroutineRetSuccessors() due to improper enforcement of the single-RET-per-JSR rule. An attacker can craft an invalid class file with multiple RET instructions for one JSR, causing the JVM to allocate approximately 2 GB of memory and crash.

CVE-2026-110257 is a vulnerability in OW2 ASM versions 5.0 up to but not including 9.11. It involves excessive memory allocation in the ClassReader.readBootstrapMethodsAttribute() method, where an int array is sized based on an unvalidated attribute_length. A crafted class file of about 100 bytes can trigger allocation of roughly 2 GB of memory, causing an OutOfMemoryError that crashes the JVM or consumes the thread.