p PatchFirst

CVE-2026-110259

CVE-2026-110259 · OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.

CVSS 6.8 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • asm

    Versions
    • ≥ 3.0, < 9.11: Affected (custom)

    Update to 9.11

  • asm Debian:12

    Versions
    • 9.10.1-1
    • 9.11.1-1
    • 9.4-1
    • 9.5-1
    • 9.7-1
    • 9.7-2
    • 9.7.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Debian:13

    Versions
    • 9.10.1-1
    • 9.11.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Debian:14

    Versions
    • 9.10.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: < 9.11.1-1

    Update to 9.11.1-1

  • asm Ubuntu:18.04:LTS

    Versions
    • 6.0~alpha-1
    • 6.0~alpha-2
    • 6.0-1
    • 7.0-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:20.04:LTS

    Versions
    • 7.1-2
    • 7.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:22.04:LTS

    Versions
    • 9.1-1
    • 9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:24.04:LTS

    Versions
    • 9.4-1
    • 9.5-1
    • 9.6~us1-0ubuntu1
    • 9.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:26.10

    Versions
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:26.04:LTS

    Versions
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →