CVE-2026-110270
Public on 2026-10-14
Modified on 2026-10-20
Description
OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2023 | bsh | Not Affected | ||
| Amazon Linux 2027 Preview | bsh | Not Affected | ||
| Amazon Linux 2 - Core | byteman | Pending Fix | ||
| Amazon Linux 2023 | byteman | Pending Fix | ||
| Amazon Linux 2027 Preview | byteman | Pending Fix | ||
| Amazon Linux 2023 | javapackages-bootstrap | Pending Fix | ||
| Amazon Linux 2027 Preview | javapackages-bootstrap | Pending Fix | ||
| Amazon Linux 2 - Core | objectweb-asm | Pending Fix | ||
| Amazon Linux 2023 | objectweb-asm | Pending Fix | ||
| Amazon Linux 2027 Preview | objectweb-asm | Pending Fix | ||
| Amazon Linux 2 - Core | objectweb-asm4 | Pending Fix | ||
| Amazon Linux 2023 | sisu | Not Affected | ||
| Amazon Linux 2027 Preview | sisu | Not Affected |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |