CVE-2026-110260

Awaiting Analysis Awaiting Analysis - Queue

Quadratic Memory Allocation in OW2 ASM

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110260

EUVD

EUVD-2026-101214

Affected Vendors & Products

Vendor	Product	Version / Range
OW2	ASM	3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability is a quadratic memory allocation issue in OW2 ASM versions 3.0 through 9.10. It occurs in the MethodWriter class methods computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers exploit this by providing a malicious class file with thousands of overlapping exception handlers, causing excessive memory consumption and crashing the JVM with an OutOfMemoryError.

Detection Guidance

To detect this vulnerability, check if your system uses OW2 ASM versions 3.0 through 9.10. Inspect the ASM library version in your Java application dependencies or classpath. If you are processing class files with ASM and encounter OutOfMemoryError crashes during bytecode manipulation, this may indicate exploitation.

Impact Analysis

This vulnerability can cause denial-of-service by crashing the JVM when processing a specially crafted class file. It requires local access and the ability to provide malicious input, but no special privileges. Systems using vulnerable ASM versions for bytecode manipulation or analysis may experience unexpected crashes.

Compliance Impact

This vulnerability causes system crashes via OutOfMemoryError, which could lead to denial of service conditions. Such disruptions may impact availability of personal data processing systems, potentially violating GDPR's requirement for secure and resilient processing (Article 32) and HIPAA's availability requirements for covered entities.

Mitigation Strategies

Upgrade to ASM version 9.11 or later, which includes fixes for this issue. If upgrading is not immediately possible, avoid using COMPUTE_MAXS or COMPUTE_FRAMES options in MethodWriter and restrict untrusted input processing.

Hi! I’m here to help you understand CVE-2026-110260. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70