CVE-2026-110260
Public on 2026-10-14
Modified on 2026-10-20
Description
OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2023 | bsh | Not Affected | ||
| Amazon Linux 2027 Preview | bsh | Not Affected | ||
| Amazon Linux 2 - Core | byteman | Pending Fix | ||
| Amazon Linux 2023 | byteman | Pending Fix | ||
| Amazon Linux 2027 Preview | byteman | Pending Fix | ||
| Amazon Linux 2023 | javapackages-bootstrap | Pending Fix | ||
| Amazon Linux 2027 Preview | javapackages-bootstrap | Pending Fix | ||
| Amazon Linux 2 - Core | objectweb-asm | Pending Fix | ||
| Amazon Linux 2023 | objectweb-asm | Pending Fix | ||
| Amazon Linux 2027 Preview | objectweb-asm | Pending Fix | ||
| Amazon Linux 2 - Core | objectweb-asm4 | Pending Fix | ||
| Amazon Linux 2023 | sisu | Pending Fix | ||
| Amazon Linux 2027 Preview | sisu | Pending Fix |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |