CVE-2026-110257 OW2 CVE debrief

Who should care

Defenders responsible for OW2 ASM deployments, especially those processing untrusted class files, should assess exposure and prioritize updates to version 9.11 or later. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams that need to verify input validation and sanitization processes for class files. They should also monitor JVM performance and review compensating controls for unex

Why it matters

Defenders should care about CVE-2026-110257 because it allows for potential JVM crashes and denial of service through excessive memory allocation in OW2 ASM 5.0 before 9.11. Verification of exposure, input validation, and updating to version 9.11 or later are crucial.

• Potential JVM crashes due to OutOfMemoryError
• Possible denial of service through excessive memory consumption
• Need for verification of input class file validation and sanitization
• Priority on updating OW2 ASM to version 9.11 or later

Technical summary

The ClassReader.readBootstrapMethodsAttribute() method in OW2 ASM 5.0 before 9.11 does not validate the attribute_length when sizing an int array from num_bootstrap_methods. This allows attackers to supply a crafted class file that causes excessive memory allocation, leading to an OutOfMemoryError. The issue is caused by inadequate validation of the attribute_length, which can be exploited by a crafted class file of about 100 bytes to force roughly 2 GB allocation. Defenders should focus on updating OW2 ASM to version 9.11 or later and validating input class files.

Defensive priority

Defenders should prioritize verifying and updating OW2 ASM to version 9.11 or later, especially in environments where untrusted class files may be processed.

Recommended defensive actions

• Verify OW2 ASM version and update to 9.11 or later if vulnerable
• Review and validate input class files to prevent crafted file processing
• Monitor JVM performance and OutOfMemoryError occurrences
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in OW2 ASM versions 5.0 through 9.10.1. Official patches and release notes are available, but no active exploitation has been reported. Defenders should verify exposure by checking their current OW2 ASM version and review input class file validation and sanitization processes. Evidence limits are based on available source information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.