Medium severity · published Oct 14, 2026
CVE-2026-110263
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ASM · OW2
3.0 before 9.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110263
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110263
patch
https://gitlab.ow2.org/asm/asm/-/merge_requests/465
patch
https://gitlab.ow2.org/asm/asm/-/commit/8f87fc0317a4c5ee8f538bcbb641928def25dbd6
technical-description
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/signature/SignatureReader.java#L151
release-notes
https://asm.ow2.io/versions.html
third-party-advisory
https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-uncontrolled-recursion-in-signaturereader
More from ASM
5.5
CVE-2026-112046
OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
5.5
CVE-2026-110591
OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
5.5
CVE-2026-110270
OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
5.5
CVE-2026-110261
OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES
5.5
CVE-2026-110260
OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers