CVE-2026-110260 — OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers
OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_…
Published: 2026-10-14 · CVSS: 6.8 · CVSS 4.0
OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7