CVE-2026-110262

Awaiting Analysis Awaiting Analysis - Queue

Excessive Memory Allocation in OW2 ASM

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in forwardJumpStackFrames and allocation of hundreds of megabytes, leading to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110262

EUVD

EUVD-2026-101216

Affected Vendors & Products

Vendor	Product	Version / Range
OW2	ASM	3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is an excessive memory allocation issue in OW2 ASM versions 3.1 through 9.10. It occurs in the AdviceAdapter component of the asm-commons library. Attackers can exploit it by providing specially crafted class files with many forward jump targets in constructors. This triggers unbounded stack copies in the forwardJumpStackFrames method, causing the system to allocate hundreds of megabytes of memory, leading to a denial of service.

Detection Guidance

To detect this vulnerability, inspect Java applications using OW2 ASM versions 3.1 through 9.10. Check for excessive memory usage during class file processing, particularly in constructors with many forward jump targets. Monitor for denial of service symptoms like system slowdowns or crashes when processing bytecode.

Impact Analysis

This vulnerability can cause denial of service by consuming excessive memory resources. If exploited, it may crash applications or systems processing the crafted class files, leading to service unavailability. Developers using affected ASM versions should update to version 9.11 or later to mitigate the risk.

Compliance Impact

This vulnerability primarily causes denial of service by exhausting memory resources, which may indirectly impact compliance with standards like GDPR or HIPAA by disrupting system availability. However, the CVE does not directly address data protection or privacy implications.

Mitigation Strategies

Upgrade to ASM version 9.11 or later, which includes fixes for this issue. If upgrading is not possible, restrict access to systems processing untrusted class files or implement resource limits to prevent memory exhaustion.

Hi! I’m here to help you understand CVE-2026-110262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70