CVE-2026-110257: OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute

Q: Which deployments are exposed to denial of service?

Deployments using affected OW2 ASM versions are exposed when they process a crafted class file. The impact is JVM or processing-thread failure from an OutOfMemoryError, or substantial memory consumption.

Q: What does an attacker need to provide?

An attacker needs to get a crafted class file processed by the affected ASM ClassReader code. The crafted file can be approximately 100 bytes and does not require authentication according to the supplied vector.

Q: What is the remediation version?

Upgrade to OW2 ASM 9.11 or later. Versions from 5.0 before 9.11 are identified as affected.

Published Oct 14, 2026

Updated

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from numbootstrapmethods without validating attributelength. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB allocation, causing an OutOfMemoryError that crashes the JVM or consuming thread.

Affected Software

1 affected component

OW2 ASM>=5.0<9.11

Event History

Oct 14, 2026

CVE Published

via MITRE·02:16 PM

Data Sourced

via MITRE·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to denial of service?

Deployments using affected OW2 ASM versions are exposed when they process a crafted class file. The impact is JVM or processing-thread failure from an OutOfMemoryError, or substantial memory consumption.

What does an attacker need to provide?

An attacker needs to get a crafted class file processed by the affected ASM ClassReader code. The crafted file can be approximately 100 bytes and does not require authentication according to the supplied vector.

What is the remediation version?