CVE-2026-110260 OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS or COMPUTEFRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames and computeMaxStackAndLocal methods in MethodWriter. When ASM processes a crafted class file with thousands of overlapping exception handlers using COMPUTEFRAMES or COMPUTEMAXS...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames and computeMaxStackAndLocal methods in MethodWriter. When ASM processes a crafted class file with thousands of overlapping exception handlers using COMPUTEFRAMES or COMPUTEMAXS...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames and computeMaxStackAndLocal methods in MethodWriter. When ASM processes a crafted class file with thousands of overlapping exception handlers using COMPUTEFRAMES or COMPUTEMAXS...

CVE-2026-110260: Inefficient Algorithmic Complexity

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS or COMPUTEFRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge...

PT-2026-114026

Name of the Vulnerable Software and Affected Versions OW2 ASM versions prior to 9.11 Description An issue exists where quadratic memory allocation occurs within the MethodWriter.computeMaxStackAndLocal and computeAllFrames functions when using COMPUTE MAXS or COMPUTE FRAMES. A remote actor can...