CVE-2026-110260

About vulnerability

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.

Affected product:

Apache CXF , Apache Commons , Apache Hadoop , Apache Hive , Apache Log4j , Apache Lucene , Apache Maven , Apache Solr , Apache Struts , Apache Tapestry , Eclipse Jetty , Elasticsearch , Hazelcast , Kotlin , Netty , OkHttp , Plexus , Spring , Wildfly , activemq , allocation-instrumenter , alluxio , animal-sniffer , artemis , asciidoctorj , asm , aws-sdk-java-v2 , azure-kusto-java , azure-sdk-for-java , byte-buddy , calcite , camel , cassandra-java-driver , cglib , chill , chronicle-engine , chronicle-map , cocoon , com.orientechnologies:orientdb-core , compile-testing , console , corda , corda-api , debezium , easymock , eureka , findbugs , flink , geode , geronimo-xbean , gizmo , glassfish-hk2 , google-http-java-client , grails-core , groovy , grpc-java , gwt , gwtp , handlebars.java , hbase , hystrix , ignite , infinispan , io.airlift:bytecode , io.quarkus:quarkus-credentials-deployment , io.quarkus:quarkus-datasource-deployment-spi , io.quarkus:quarkus-jdbc-postgresql , io.quarkus:quarkus-resteasy , java-client , java-driver , java-lang , jbossws-cxf , jdependency , jersey , jitescript , jmock-library , jnr-enxio , jnr-ffi , jnr-fuse , jnr-netdb , jnr-posix , jnr-unixsocket , jruby , json-smart , jsonpath , karaf , kite , kryo , kryo-serializers , maven , micrometer , micronaut-core , microsoft-authentication-library-for-java , mustache.java , narayana , nashorn , neo4j , neo4j-ogm , nimbus-jose-jwt , oauth-2.0-sdk-with-openid-connect-extensions , org.apache.groovy:groovy-all , org.graalvm.js:js , org.wildfly:wildfly-ormtransformer , orientdb , pravega , processor , protostream , pulsar , quarkus , redisson , reflectasm , resteasy , sentimentanalysisparser , sisu-project , sisu.plexus , smallrye-config , smallrye-health , spotbugs , storm , tephra , testcontainers-java , tika , trino , truth , twill , web3j , web3j-quorum , wiremock

Affected packages:

asm @ 9.6 (+23220 more)