CVE-2026-110259

Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Recursion in OW2 ASM ClassWriter

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110259

EUVD

EUVD-2026-101213

Affected Vendors & Products

Vendor	Product	Version / Range
OW2	ASM	3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

OW2 ASM versions 3.0 through 9.10 have an uncontrolled recursion flaw in ClassWriter.replaceAsmInstructions(). Attackers exploit this by providing a malicious class file with a large method containing many long forward jumps. This triggers infinite recursion in toByteArray(), causing a StackOverflowError during class transformation.

Detection Guidance

To detect this vulnerability, check the version of OW2 ASM in use. If your system uses ASM versions 3.0 through 9.10, it is vulnerable. Commands like 'find / -name "asm*.jar" 2>/dev/null' can help locate ASM libraries. Verify versions with 'java -jar asm.jar -version' if available.

Impact Analysis

If you process untrusted class files using vulnerable ASM versions, attackers could crash your application with a denial of service. This affects systems transforming Java classes, especially those handling user-provided or third-party class files.

Compliance Impact

This vulnerability causes denial of service through stack overflow errors, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing. For HIPAA, service disruption could affect protected health information access. However, direct compliance impact depends on system configuration and mitigations.

Mitigation Strategies

Upgrade OW2 ASM to version 9.11 or later immediately. This version addresses the uncontrolled recursion flaw. If upgrading is not possible, restrict access to systems processing untrusted class files to reduce exposure.

Hi! I’m here to help you understand CVE-2026-110259. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70