CVE-2026-110263
Public on 2026-10-14
Modified on 2026-10-20
Description
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2023 | bsh | Not Affected | ||
| Amazon Linux 2027 Preview | bsh | Not Affected | ||
| Amazon Linux 2 - Core | byteman | Pending Fix | ||
| Amazon Linux 2023 | byteman | Pending Fix | ||
| Amazon Linux 2027 Preview | byteman | Pending Fix | ||
| Amazon Linux 2023 | javapackages-bootstrap | Pending Fix | ||
| Amazon Linux 2027 Preview | javapackages-bootstrap | Pending Fix | ||
| Amazon Linux 2 - Core | objectweb-asm | Pending Fix | ||
| Amazon Linux 2023 | objectweb-asm | Pending Fix | ||
| Amazon Linux 2027 Preview | objectweb-asm | Pending Fix | ||
| Amazon Linux 2 - Core | objectweb-asm4 | Pending Fix | ||
| Amazon Linux 2023 | sisu | Not Affected | ||
| Amazon Linux 2027 Preview | sisu | Not Affected |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |