< Back

CVE-2026-110270

Updated on 14 Oct 2026

Severity

6.8 Medium severity

Details

CVSS score
6.8
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM.

Details

Affected product:
Apache CXF , Apache Commons , Apache Hadoop , Apache Hive , Apache Log4j , Apache Lucene , Apache Solr , Apache Struts , Eclipse Jetty , OkHttp , Spring , activemq , allocation-instrumenter , alluxio , artemis , asciidoctorj , asm , byte-buddy , camel , cassandra-java-driver , chill , cocoon , com.orientechnologies:orientdb-core , console , debezium , findbugs , flink , geronimo-xbean , glassfish-hk2 , google-http-java-client , grails-core , gwt , gwtp , handlebars.java , hbase , io.quarkus:quarkus-credentials-deployment , io.quarkus:quarkus-datasource-deployment-spi , java-driver , jdependency , jersey , jnr-enxio , jnr-ffi , jnr-fuse , jnr-netdb , jnr-posix , jnr-unixsocket , jruby , kite , micronaut-core , mustache.java , nashorn , org.graalvm.js:js , orientdb , pravega , pulsar , quarkus , redisson , spotbugs , testcontainers-java , web3j , web3j-quorum
Affected packages:
asm @ 9.6 (+17973 more)