CVE-2026-110258
Public on 2026-10-14
Modified on 2026-10-20
Description
OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation that crashes the JVM.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2023 | bsh | Not Affected | ||
| Amazon Linux 2027 Preview | bsh | Not Affected | ||
| Amazon Linux 2 - Core | byteman | Pending Fix | ||
| Amazon Linux 2023 | byteman | Pending Fix | ||
| Amazon Linux 2027 Preview | byteman | Pending Fix | ||
| Amazon Linux 2023 | javapackages-bootstrap | Pending Fix | ||
| Amazon Linux 2027 Preview | javapackages-bootstrap | Pending Fix | ||
| Amazon Linux 2 - Core | objectweb-asm | Pending Fix | ||
| Amazon Linux 2023 | objectweb-asm | Pending Fix | ||
| Amazon Linux 2027 Preview | objectweb-asm | Pending Fix | ||
| Amazon Linux 2 - Core | objectweb-asm4 | Pending Fix | ||
| Amazon Linux 2023 | sisu | Pending Fix | ||
| Amazon Linux 2027 Preview | sisu | Pending Fix |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |