PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110259 OW2 CVE debrief

A vulnerability in OW2 ASM 3.0 before 9.11 allows for uncontrolled recursion via ClassWriter.replaceAsmInstructions(), potentially leading to denial of service through crafted class files. The vulnerability is caused by the lack of proper bounds checking on the number of forward jumps in a method, allowing an attacker to trigger unbounded recursion and a StackOverflowError during transformation. Defenders should assess exposure and apply the patch from OW2 to prevent potential denial of service.

Vendor
OW2
Product
ASM
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for systems using OW2 ASM 3.0 through 9.10 should assess exposure and apply the patch from OW2. Operators of systems using OW2 ASM 3.0 through 9.10 should verify exposure and apply the patch to prevent potential denial of service. Vulnerability management and security teams should prioritize verifying exposure and applying the patch.

Why it matters

Defenders should prioritize verifying exposure in systems using OW2 ASM 3.0 through 9.10 and apply the patch from OW2 to prevent potential denial of service through crafted class files.

  • Potential denial of service through crafted class files.
  • Verification of exposure in systems using OW2 ASM 3.0 through 9.10.
  • Application of the patch from OW2 to prevent potential denial of service.

Technical summary

The vulnerability in OW2 ASM 3.0 before 9.11 is caused by uncontrolled recursion in ClassWriter.replaceAsmInstructions(). An attacker can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation. The vulnerability allows attackers to cause denial of service through crafted class files. The patch from OW2 should be applied to prevent potential denial of service. No additional technical details are available on the vulnerability or exploitation.

Defensive priority

Defenders should prioritize verifying exposure in systems using OW2 ASM 3.0 through 9.10 and applying the patch from OW2.

Recommended defensive actions

  • Verify if systems using OW2 ASM 3.0 through 9.10 are exposed to potential denial of service via crafted class files.
  • Apply the patch from OW2 referenced in the source item.
  • Monitor for crafted class files being processed by OW2 ASM in your environment.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability in OW2 ASM 3.0 before 9.11. Limited information is available on actual exploitation or victim impact. The vulnerability is caused by uncontrolled recursion in ClassWriter.replaceAsmInstructions(). An attacker can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation. No additional information is available on the extent of exploitation or specific victim impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110259 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110259

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110259 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110259

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110259.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/merge_requests/459

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/commit/e9aca627c17e1619bcb8059afb43382dac6b275f

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/ClassWriter.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://asm.ow2.io/versions.html

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-uncontrolled-recursion-via-classwriter-replaceasminstructions

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.