CVE-2026-110263: OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader

Q: What must an attacker be able to do to trigger the denial of service?

The attacker must be able to supply a crafted class file that is processed during class transformation. The class file needs a Signature attribute containing deeply nested generic type arguments.

Q: What is the practical impact when exploitation succeeds?

Parsing the crafted signature can cause SignatureReader.parseType() to recurse until it throws a StackOverflowError. This can disrupt the class-transformation operation and cause denial of service.

Q: Which versions are affected?

OW2 ASM versions from 3.0 before 9.11 are affected.

Published Oct 14, 2026

Updated

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.

Affected Software

1 affected component

OW2 ASM>=3.0<9.11

Event History

Oct 14, 2026

CVE Published

via MITRE·02:16 PM

Data Sourced

via MITRE·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker be able to do to trigger the denial of service?

The attacker must be able to supply a crafted class file that is processed during class transformation. The class file needs a Signature attribute containing deeply nested generic type arguments.

What is the practical impact when exploitation succeeds?

Parsing the crafted signature can cause SignatureReader.parseType() to recurse until it throws a StackOverflowError. This can disrupt the class-transformation operation and cause denial of service.

Which versions are affected?