Medium
OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM.
Announced Source revision 1
Original source ↗CVE-2026-110270
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-110270
ASM
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://gitlab.ow2.org/asm/asm",
"vendor": "OW2",
"product": "ASM",
"versions": [
{
"status": "affected",
"version": "3.0",
"lessThan": "9.11",
"versionType": "custom"
}
],
"packageURL": "pkg:maven/org.ow2.asm/asm-commons",
"collectionURL": "https://repo1.maven.org/maven2/",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-110270
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #21983 · Revision 1
- Added to Heist Feed
- Publisher date