What’s Vulnerable › Vulnerabilities

CVE-2026-110262: OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-14
• Weakness: CWE-770

Description

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in forwardJumpStackFrames and allocation of hundreds of megabytes, leading to denial of service.

Affected products

• OW2 ASM: from 3.1 before 9.11 — fixed in 9.11

How to fix

Upgrade to a fixed version: OW2 ASM 9.11. Check the vendor advisory for mitigations.

References

• https://asm.ow2.io/versions.html
• https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-commons/src/main/java/org/objectweb/asm/commons/AdviceAdapter.java#L96
• https://gitlab.ow2.org/asm/asm/-/commit/b7e6c88801790c9da214efd0498aecb9402796a0
• https://gitlab.ow2.org/asm/asm/-/merge_requests/464
• https://www.vulncheck.com/advisories/ow2-asm-3.1-before-9.11-excessive-memory-allocation-in-adviceadapter

Get alerted when CVE-2026-110262 or the next vulnerability affects your stack