CVE-2026-110263
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
OW2 ASM
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 9.11ASMCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.
Text from CVE List
Affected versions 1
- ASMaffected: 3.0 before 9.11CVE List
References 5
- gitlab.ow2.org/asm/asm/-/merge_requests/465Fixvia CVE List
- gitlab.ow2.org/asm/asm/-/commit/8f87fc0317a4c5ee8f538bcbb641928def25dbd6Fixvia CVE List
- vulncheck.com/advisories/ow2-asm-3.0-before-9.11-uncontrolled-recursion-in-signaturereaderAdvisoryvia CVE List
- gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/signature/SignatureReader.java#L151Referencevia CVE List
- asm.ow2.io/versions.htmlReferencevia CVE List