CVE-2026-110259: OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()

Q: What conditions are required to trigger the denial of service?

An attacker must be able to supply a crafted class file for transformation. The class must contain a large method with many long forward jumps, which can cause unbounded recursion in toByteArray() and result in a StackOverflowError.

Q: Is user interaction required?

The supplied severity vector indicates user interaction is required. The vulnerability is locally exploitable and does not require privileges.

Q: What versions are affected?

OW2 ASM versions from 3.0 before 9.11 are affected.

Published Oct 14, 2026

Updated

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.

Affected Software

1 affected component

OW2 ASM>=3.0<9.11

Event History

Oct 14, 2026

CVE Published

via MITRE·02:16 PM

Data Sourced

via MITRE·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to trigger the denial of service?

An attacker must be able to supply a crafted class file for transformation. The class must contain a large method with many long forward jumps, which can cause unbounded recursion in toByteArray() and result in a StackOverflowError.

Is user interaction required?

The supplied severity vector indicates user interaction is required. The vulnerability is locally exploitable and does not require privileges.

What versions are affected?