CVE-2026-110263

Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Recursion in OW2 ASM SignatureReader

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110263

EUVD

EUVD-2026-101217

Affected Vendors & Products

Vendor	Product	Version / Range
OW2	ASM	3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled recursion flaw in OW2 ASM 3.0 before 9.11. It occurs in the SignatureReader.parseType() method where attackers can cause a StackOverflowError by providing a crafted class file with deeply nested generic type signatures. This leads to a denial of service during class transformation due to stack exhaustion.

Detection Guidance

Detecting this vulnerability requires checking the version of OW2 ASM in use. If you are using ASM versions 3.0 through 9.10, your system is vulnerable. Run commands like 'find / -name "asm*.jar" 2>/dev/null' to locate ASM libraries and check their versions.

Impact Analysis

This vulnerability can cause denial of service by crashing applications that use affected ASM versions when processing maliciously crafted class files. It may disrupt services relying on class transformation, such as Java bytecode manipulation tools or frameworks.

Compliance Impact

This vulnerability causes denial of service via stack exhaustion, which could disrupt availability of systems processing sensitive data. For GDPR, this may impact data availability rights under Article 12-17. For HIPAA, it could affect access to protected health information during critical operations. However, the vulnerability itself does not directly violate compliance but may contribute to non-compliance if exploited to disrupt regulated systems.

Mitigation Strategies

Upgrade OW2 ASM to version 9.11 or later immediately. This version addresses the uncontrolled recursion flaw. If upgrading is not possible, restrict access to systems using ASM or implement input validation for class files to prevent malicious signatures.

Hi! I’m here to help you understand CVE-2026-110263. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70