CVE-2026-110270 OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O2^n memory allocation, causing an...

CVE-2026-110270

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O2^n memory allocation, causing an...

EUVD-2026-101214

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS or COMPUTEFRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge...

CVE-2026-110260 OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS or COMPUTEFRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge...

CVE-2026-110260 OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS or COMPUTEFRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge...

CVE-2026-110260

OW2 ASM 3.0 versions before 9.11 are vulnerable to a quadratic memory allocation issue within the MethodWriter.computeMaxStackAndLocal() and computeAllFrames() methods. When processing a crafted class file containing thousands of overlapping exception handlers while using COMPUTE_MAXS or COMPUTE_...

CVE-2026-110260

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS or COMPUTEFRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge...

CVE-2026-110258 OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

CVE-2026-110258 OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

EUVD-2026-101212

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

CVE-2026-110258

The OW2 ASM 3.0 library, in versions prior to 9.11 , contains an excessive memory allocation vulnerability in the Label.addSubroutineRetSuccessors() method. The root cause is a failure to enforce the single-RET-per-JSR rule, allowing an attacker to provide a crafted invalid class file containing ...

CVE-2026-110258 OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

CVE-2026-110258

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

CVE-2026-110258

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

CVE-2026-110257

OW2 ASM 5.0 versions prior to 9.11 are vulnerable to an excessive memory allocation vulnerability within the ClassReader.readBootstrapMethodsAttribute() function. The root cause is the failure to validate attribute_length when sizing an int array from num_bootstrap_methods . An attacker can provi...

Security update for libtcnative-2-0

This update for libtcnative-2-0 fixes the following issues: CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash bsc1282623. CVE-2026-86246: insecure ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF and ALLOWNODHEK...

SUSE-SU-2026:4658-1 Security update for libtcnative-2-0

This update for libtcnative-2-0 fixes the following issues: - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash bsc1282623. - CVE-2026-86246: insecure ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF and...

PT-2026-114024

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

CVE-2026-110258: Memory Allocation with Excessive Size Value

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

Security Bulletin:Vulnerabilities exists in zstd package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-89045 DESCRIPTION: zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in...