CVE-2026-110270: OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to provide to trigger the issue?
An attacker needs to supply a crafted Java class file containing nested JSR/RET subroutines. Processing that file through asm-commons JSRInlinerAdapter can cause exponential memory allocation.
What systems are realistically exposed?
Systems are exposed when they use the affected ASM versions and pass attacker-supplied or otherwise untrusted class files to JSRInlinerAdapter for JSR/RET subroutine inlining. Successful exploitation can exhaust JVM memory and crash the JVM with an OutOfMemoryError.