CVE-2026-110258
OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions
OW2 ASM
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 9.11ASMCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation that crashes the JVM.
Text from CVE List
Affected versions 1
- ASMaffected: 3.0 before 9.11CVE List
References 5
- gitlab.ow2.org/asm/asm/-/merge_requests/458Fixvia CVE List
- gitlab.ow2.org/asm/asm/-/commit/4dabfe0aef14f8cccb0617640a4add8fbcc4ed36Fixvia CVE List
- vulncheck.com/advisories/ow2-asm-3.0-before-9.11-excessive-memory-allocation-via-multiple-ret-instructionsAdvisoryvia CVE List
- gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/Label.java#L568Referencevia CVE List
- asm.ow2.io/versions.htmlReferencevia CVE List