PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110258 OW2 CVE debrief

The OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. This vulnerability can lead to JVM crashes due to roughly 2 GB allocations triggered by crafted invalid class files with multiple RET instructions for one JSR. Defenders should assess exposure, prioritize verification, and consider upgrades or patches. Evidence limits exist, and some details require verification from official sources.

Vendor
OW2
Product
ASM
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for ASM deployments, especially those using versions before 9.11, should assess exposure and prioritize verification and potential upgrades or patches. Relevant roles include those responsible for ASM deployments, vulnerability management, and security teams. They should also monitor for potential memory issues and crashes, and review compensating controls for exposed systems.

Why it matters

Defenders should care about CVE-2026-110258 because it affects OW2 ASM 3.0 before 9.11, potentially leading to JVM crashes due to excessive memory allocation. Relevant roles include those responsible for ASM deployments. The vulnerability supports specific defensive consequences, including verification of exposure, prioritization of upgrades or patches, and monitoring for memory issues. Evidence limits exist, and some details require verification from official sources.

  • Potential JVM crashes due to excessive memory allocation
  • Need for verification of ASM version and exposure
  • Priority for upgrading to ASM 9.11 or applying patches
  • Monitoring for potential memory issues and crashes

Technical summary

The OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation that crashes the JVM. This issue affects ASM deployments, especially those using versions before 9.11, and requires verification of exposure and potential upgrades or patches. The vulnerability supports specific defensive consequences, including verification of exposure, prioritization of upgrades or patches, and monitoring for memory issues.

Defensive priority

Defenders should prioritize verifying exposure in ASM deployments, especially for versions before 9.11, and assess the feasibility of upgrading to 9.11 or applying patches.

Recommended defensive actions

  • Verify ASM version and assess exposure
  • Upgrade to ASM 9.11 or apply patches
  • Monitor for potential crashes and memory issues
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets
  • Plan vendor-supported updates through normal change control

Evidence notes

The CVE record and source item provide details on the excessive memory allocation vulnerability in OW2 ASM 3.0 before 9.11. The vulnerability is caused by the failure to enforce the single-RET-per-JSR rule in Label.addSubroutineRetSuccessors().

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110258 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110258

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110258 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110258

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110258.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/merge_requests/458

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/commit/4dabfe0aef14f8cccb0617640a4add8fbcc4ed36

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/Label.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://asm.ow2.io/versions.html

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-excessive-memory-allocation-via-multiple-ret-instructions

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.