CVE-2026-110258mediumCWE-789

CVE-2026-110258: falha de média gravidade em OW2 ASM

OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions

Publicada em

Seguir esta CVE+ Monitorar ASM+ Monitorar asm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.2%
OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation that crashes the JVM.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
OW2 · ASM
CVEs relacionadas — OW2 ASM

No mesmo produto, das mais perigosas para as menos.

CVE-2026-110591MEDIUMOW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via AnalyzerEPSS 0.2%CVE-2026-110260MEDIUMOW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception HandlersEPSS 0.2%CVE-2026-110270MEDIUMOW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapterEPSS 0.2%CVE-2026-110263MEDIUMOW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReaderEPSS 0.2%CVE-2026-110261MEDIUMOW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMESEPSS 0.2%CVE-2026-110259MEDIUMOW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()EPSS 0.2%