CVE-2026-110260: OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers
OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTEMAXS or COMPUTEFRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using OW2 ASM versions from 3.0 through versions before 9.11 are exposed when they process attacker-supplied or otherwise untrusted class files with COMPUTE_MAXS or COMPUTE_FRAMES enabled.
What does an attacker need to trigger the denial of service?
An attacker needs to provide a crafted class file containing thousands of overlapping exception handlers. Processing that class can cause excessive Edge allocations, leading to an OutOfMemoryError and JVM crash.
Is exploitation dependent on an authenticated or privileged attacker?
No privileges are indicated as necessary. However, the attacker must be able to cause the application to process the crafted class file, and user interaction is required according to the supplied CVSS vector.
How can I determine whether my application is affected?
Check whether the application includes OW2 ASM before 9.11 and invokes ASM with COMPUTE_MAXS or COMPUTE_FRAMES while handling class files that may be attacker-controlled. The vulnerable code paths are MethodWriter.computeMaxStackAndLocal() and computeAllFrames().