PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110260 OW2 CVE debrief

The CVE-2026-110260 vulnerability in OW2 ASM 3.0 before 9.11 involves a quadratic memory allocation issue via exception handlers in MethodWriter.computeMaxStackAndLocal() and computeAllFrames(). This flaw allows attackers to supply crafted class files with thousands of overlapping exception handlers, leading to excessive Edge allocations and potential OutOfMemoryError crashes in the JVM. Defenders should assess exposure, especially in versions before 9.11, and consider upgrades or patches. The vulnerability's impact includes verification of exposure, potential for OutOfMemoryError crashes, and the need for upgrading or patching.

Vendor
OW2
Product
ASM
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for OW2 ASM deployments, especially those using versions before 9.11, should assess exposure and prioritize verification and potential upgrades or patches. This includes operators, platform administrators, vulnerability management teams, and security teams who need to evaluate the impact on their environments and plan accordingly to prevent potential OutOfMemoryError crashes and ensure the security of their deployments.

Why it matters

Defenders should prioritize verifying exposure in ASM deployments, especially those using versions before 9.11, and assess the feasibility of upgrading to version 9.11 or applying patches due to a quadratic memory allocation vulnerability.

  • Verification of exposure in ASM deployments, especially those using versions before 9.11
  • Potential for OutOfMemoryError crashes in JVM
  • Need for upgrading to version 9.11 or applying patches

Technical summary

The vulnerability in OW2 ASM 3.0 before 9.11 is caused by flaws in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can exploit this by supplying crafted class files with thousands of overlapping exception handlers, leading to excessive Edge allocations and potential OutOfMemoryError crashes in the JVM. This issue highlights the importance of verifying exposure, especially in versions before 9.11, and considering upgrades or patches to mitigate the risk.

Defensive priority

Defenders should prioritize verifying exposure in ASM deployments, especially those using versions before 9.11, and assess the feasibility of upgrading to version 9.11 or applying patches.

Recommended defensive actions

  • Verify exposure in ASM deployments, especially those using versions before 9.11
  • Assess the feasibility of upgrading to version 9.11 or applying patches
  • Monitor for potential OutOfMemoryError crashes in JVM
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on a quadratic memory allocation vulnerability in OW2 ASM 3.0 before 9.11. The vulnerability is caused by a flaw in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110260 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110260

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110260 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110260

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110260.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/merge_requests/461

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/commit/91057c98239d994aed5e46434e34e00d593c0daf

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/MethodWriter.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://asm.ow2.io/versions.html

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-quadratic-memory-allocation-via-exception-handlers

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.