CVE-2026-110263mediumCWE-674

CVE-2026-110263: medium-severity vulnerability in OW2 ASM

OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader

Published

Follow this CVE+ Monitor ASM+ Monitor asm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.2%
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
OW2 · ASM
Related CVEs — OW2 ASM

In the same product, most dangerous first.

CVE-2026-110591MEDIUMOW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via AnalyzerEPSS 0.2%CVE-2026-110260MEDIUMOW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception HandlersEPSS 0.2%CVE-2026-110270MEDIUMOW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapterEPSS 0.2%CVE-2026-110261MEDIUMOW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMESEPSS 0.2%CVE-2026-110259MEDIUMOW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()EPSS 0.2%CVE-2026-110258MEDIUMOW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET InstructionsEPSS 0.2%