p PatchFirst

CVE-2026-110260

CVE-2026-110260 · OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.

CVSS 6.8 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • asm

    Versions
    • ≥ 3.0, < 9.11: Affected (custom)

    Update to 9.11

  • asm Debian:12

    Versions
    • 9.10.1-1
    • 9.11.1-1
    • 9.4-1
    • 9.5-1
    • 9.7-1
    • 9.7-2
    • 9.7.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Debian:13

    Versions
    • 9.10.1-1
    • 9.11.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Debian:14

    Versions
    • 9.10.1-1
    • 9.11.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:18.04:LTS

    Versions
    • 6.0~alpha-1
    • 6.0~alpha-2
    • 6.0-1
    • 7.0-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:20.04:LTS

    Versions
    • 7.1-2
    • 7.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:22.04:LTS

    Versions
    • 9.1-1
    • 9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:24.04:LTS

    Versions
    • 9.4-1
    • 9.5-1
    • 9.6~us1-0ubuntu1
    • 9.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:26.10

    Versions
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:26.04:LTS

    Versions
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →