Medium severity · published Oct 14, 2026
CVE-2026-110259
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ASM · OW2
3.0 before 9.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110259
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110259
patch
https://gitlab.ow2.org/asm/asm/-/merge_requests/459
patch
https://gitlab.ow2.org/asm/asm/-/commit/e9aca627c17e1619bcb8059afb43382dac6b275f
technical-description
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/ClassWriter.java#L751
release-notes
https://asm.ow2.io/versions.html
third-party-advisory
https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-uncontrolled-recursion-via-classwriter-replaceasminstructions
More from ASM
5.5
CVE-2026-112046
OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
5.5
CVE-2026-110591
OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
5.5
CVE-2026-110270
OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
5.5
CVE-2026-110263
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
5.5
CVE-2026-110261
OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES