CVE-2026-110270 — OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work lim…
Published: 2026-10-14 · CVSS: 6.8 · CVSS 4.0
OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7