CVE-2026-110263 — OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type…
Published: 2026-10-14 · CVSS: 6.8 · CVSS 4.0
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7