CVE-2026-110270mediumCWE-407

CVE-2026-110270: falha de média gravidade em OW2 ASM

OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ASM+ Monitorar asm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.2%
OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
OW2 · ASM
CVEs relacionadas — OW2 ASM

No mesmo produto, das mais perigosas para as menos.

CVE-2026-110591MEDIUMOW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via AnalyzerEPSS 0.2%CVE-2026-110260MEDIUMOW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception HandlersEPSS 0.2%CVE-2026-110263MEDIUMOW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReaderEPSS 0.2%CVE-2026-110261MEDIUMOW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMESEPSS 0.2%CVE-2026-110259MEDIUMOW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()EPSS 0.2%CVE-2026-110258MEDIUMOW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET InstructionsEPSS 0.2%