p PatchFirst

CVE-2026-110262

CVE-2026-110262 · OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in forwardJumpStackFrames and allocation of hundreds of megabytes, leading to denial of service.

CVSS 4.8 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • asm

    Versions
    • ≥ 3.1, < 9.11: Affected (custom)

    Update to 9.11

  • asm Debian:12

    Versions
    • 9.10.1-1
    • 9.11.1-1
    • 9.4-1
    • 9.5-1
    • 9.7-1
    • 9.7-2
    • 9.7.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Debian:13

    Versions
    • 9.10.1-1
    • 9.11.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Debian:14

    Versions
    • 9.10.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: < 9.11.1-1

    Update to 9.11.1-1

  • asm Ubuntu:18.04:LTS

    Versions
    • 6.0~alpha-1
    • 6.0~alpha-2
    • 6.0-1
    • 7.0-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:20.04:LTS

    Versions
    • 7.1-2
    • 7.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:22.04:LTS

    Versions
    • 9.1-1
    • 9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:24.04:LTS

    Versions
    • 9.4-1
    • 9.5-1
    • 9.6~us1-0ubuntu1
    • 9.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:26.10

    Versions
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:26.04:LTS

    Versions
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →