CVE-2026-110270

Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Memory Allocation in OW2 ASM

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110270

EUVD

EUVD-2026-101218

Affected Vendors & Products

Vendor	Product	Version / Range
OW2	ASM	3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

OW2 ASM versions 3.0 through 9.10 have an uncontrolled memory allocation flaw in the JSRInlinerAdapter component of the asm-commons library. Attackers can exploit this by providing a malicious class file with nested subroutines, causing exponential memory usage (O(2^n)) that leads to an OutOfMemoryError and crashes the Java Virtual Machine.

Detection Guidance

To detect this vulnerability, check the version of OW2 ASM libraries in use. If your system uses ASM versions 3.0 through 9.10, it is vulnerable. Run commands like 'find / -name "asm-commons*.jar"' to locate the library and 'jar tf <path-to-jar> | grep JSRInlinerAdapter' to confirm the vulnerable component is present.

Impact Analysis

This vulnerability can crash applications running on affected ASM versions by consuming excessive memory, leading to denial-of-service conditions. Systems processing untrusted class files are particularly at risk.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing system crashes due to resource exhaustion. OutOfMemoryError may lead to service disruptions, potentially affecting data processing integrity or availability, which are key requirements under these regulations.

Mitigation Strategies

Upgrade OW2 ASM to version 9.11 or later, which includes memory and work limits to prevent excessive allocations. If upgrading is not immediately possible, restrict access to systems running vulnerable ASM versions or implement runtime monitoring for OutOfMemoryError crashes.

Hi! I’m here to help you understand CVE-2026-110270. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70