CVE-2026-110258: OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions
OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation that crashes the JVM.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use vulnerable OW2 ASM versions to process attacker-controlled or otherwise untrusted Java class files are exposed. The reported impact is JVM termination from a roughly 2 GB memory allocation.
What must an attacker provide to trigger the crash?
The attacker needs to supply a crafted invalid class file containing multiple RET instructions associated with a single JSR. The supplied severity vector indicates local attack vector and user interaction is required.
Are patched versions identified?
The issue affects OW2 ASM versions before 9.11. Updating to version 9.11 or later removes the affected version range described here.
What can be done if an update cannot be applied immediately?
Do not process untrusted class files with the affected ASM component. Restrict which users or workflows can provide class files, and isolate class-file processing so a JVM crash has limited operational impact.