CVE-2026-110260
OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers
OW2 ASM
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 9.11ASMCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.
Text from CVE List
Affected versions 1
- ASMaffected: 3.0 before 9.11CVE List
References 5
- gitlab.ow2.org/asm/asm/-/merge_requests/461Fixvia CVE List
- gitlab.ow2.org/asm/asm/-/commit/91057c98239d994aed5e46434e34e00d593c0dafFixvia CVE List
- vulncheck.com/advisories/ow2-asm-3.0-before-9.11-quadratic-memory-allocation-via-exception-handlersAdvisoryvia CVE List
- gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/MethodWriter.java#L1662Referencevia CVE List
- asm.ow2.io/versions.htmlReferencevia CVE List