PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110270 OW2 CVE debrief

The CVE-2026-110270 vulnerability in OW2 ASM 3.0 before 9.11 involves an uncontrolled memory allocation issue in the asm-commons JSRInlinerAdapter, which can lead to an OutOfMemoryError, causing the JVM to crash. This vulnerability is rated with a CVSS score of 6.8 and a severity of MEDIUM. The vulnerability allows attackers to supply crafted class files with nested subroutines to force O(2^n) memory allocation. Defenders should prioritize updating to version 9.11 of OW2 ASM to mitigate this vulnerability.

Vendor
OW2
Product
ASM
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for systems using OW2 ASM 3.0 before 9.11 should assess exposure and prioritize updates to mitigate this vulnerability. This includes reviewing system configurations, verifying affected versions, and planning updates or mitigations through normal change control. Defenders should also monitor for potential OutOfMemoryErrors and review compensating controls for exposed systems.

Why it matters

The CVE-2026-110270 vulnerability in OW2 ASM 3.0 before 9.11 involves an uncontrolled memory allocation issue that can lead to OutOfMemoryErrors and JVM crashes. Defenders should prioritize updates to version 9.11 and assess systems using affected versions for exposure.

  • Potential for OutOfMemoryErrors leading to JVM crashes
  • Need for verification of affected systems and versions
  • Priority for updating to version 9.11 of OW2 ASM
  • Possible impact on system availability and stability

Technical summary

The OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter. Attackers can supply crafted class files with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM. The vulnerability is confirmed in OW2 ASM 3.0 before 9.11 and is rated with a CVSS score of 6.8 and a severity of MEDIUM. Defenders should prioritize updating to version 9.11 of OW2 ASM to mitigate this vulnerability. The issue allows for potential OutOfMemoryErrors leading to JVM crashes.

Defensive priority

Defenders should prioritize updating to version 9.11 of OW2 ASM to mitigate this vulnerability. Systems using affected versions of ASM should be assessed for exposure.

Recommended defensive actions

  • Update to OW2 ASM version 9.11 or later
  • Assess systems using affected versions of ASM for exposure
  • Monitor for potential OutOfMemoryErrors
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the JSRInlinerAdapter inlining JSR/RET subroutines without memory or work limits, allowing attackers to supply crafted class files that force O(2^n) memory allocation. The issue is confirmed in OW2 ASM 3.0 before 9.11. Evidence is based on the official CVE record and source-provided details. Defenders should verify affected systems and versions for exposure and prioritize updates to version 9.11.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110270 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110270

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110270 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110270

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110270.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/merge_requests/466

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/commit/f2b988af48719f85a274f2a05e37bc55c0cd22a1

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-commons/src/main/java/org/objectweb/asm/commons/JSRInlinerAdapter.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://asm.ow2.io/versions.html

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-exponential-memory-allocation-in-jsrinlineradapter

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.