CVE-2026-110262

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in...

CVE-2026-110263

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type argumen...

CVE-2026-110270

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O2^n memory allocation, causing an...

CVE-2026-110257

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from numbootstrapmethods without validating attributelength. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB...

CVE-2026-110259

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded...

CVE-2026-110258

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

CVE-2026-110260

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS or COMPUTEFRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge...

CVE-2026-110261

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames fix point algorithm converge slowly,...

CVE-2026-110591

OW2 ASM versions 1.4.3 before 9.11 are vulnerable to excessive resource consumption within the Analyzer.analyze() function. An attacker can provide specially crafted class files analyzed via BasicVerifier, SimpleVerifier, or SourceInterpreter to trigger unbounded per-instruction Frame allocation ...

CVE-2026-110591 OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded...

EUVD-2026-101219

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded...

CVE-2026-110270

The OW2 ASM 3.0 library (versions before 9.11 ) is vulnerable to an uncontrolled memory allocation flaw in the asm-commons JSRInlinerAdapter . The root cause is the lack of memory or work limits when inlining JSR/RET subroutines . An attacker can provide a crafted class file containing nested sub...

CVE-2026-110270 OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O2^n memory allocation, causing an...

EUVD-2026-101218

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O2^n memory allocation, causing an...

CVE-2026-110262

OW2 ASM 3.1 versions before 9.11 are vulnerable to an excessive memory allocation flaw in the asm-commons AdviceAdapter component. The root cause is that the software fails to limit memory usage when processing crafted class files. Specifically, an attacker can provide bytecode with numerous forw...

CVE-2026-110263

OW2 ASM 3.0 versions prior to 9.11 are vulnerable to an uncontrolled recursion vulnerability within the SignatureReader.parseType() function. An attacker can trigger a StackOverflowError by providing a specially crafted class file featuring a Signature attribute with deeply nested generic type si...

CVE-2026-110263 OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type argumen...

CVE-2026-110262 OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in...

EUVD-2026-101217

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type argumen...

EUVD-2026-101216

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in...