CVE-2026-110259 in ASM
Summary
by MITRE • 10/14/2026
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The OW2 ASM library is a widely used Java bytecode manipulation and analysis framework that enables developers to generate, transform, or analyze existing classes in various formats such as class files, arrays, or strings. Within this ecosystem, the ClassWriter component plays a critical role in generating new bytecodes by handling method instructions and managing control flow structures like jumps. A significant security flaw was identified in versions of ASM prior to 9.11, specifically within the replaceAsmInstructions() method of the ClassWriter class. This vulnerability stems from an uncontrolled recursion mechanism that can be triggered when processing specially crafted Java class files containing complex or maliciously constructed bytecode sequences.
The technical root cause of this vulnerability lies in how the library handles forward jump instructions during the transformation process. When a class file contains methods with numerous long forward jumps, the internal logic responsible for replacing ASM-specific instructions enters into an unbounded recursive loop. Specifically, the toByteArray() method, which is invoked to finalize and output the modified bytecode, relies on this recursive processing step. If the input data includes deeply nested or excessively large jump structures, the recursion depth exceeds the available stack space allocated by the Java Virtual Machine. This results in a StackOverflowError, effectively crashing the application that utilizes the ASM library for class transformation.
From an operational perspective, this vulnerability poses a severe risk of denial of service against any system relying on ASM to process untrusted or dynamically generated bytecode. Since many enterprise applications use ASM for features such as dynamic proxy generation, aspect-oriented programming, or runtime code instrumentation, attackers can exploit this flaw by supplying malicious class files through file uploads, network inputs, or other entry points where bytecode transformation occurs. The impact is immediate and disruptive, leading to application crashes without requiring further exploitation steps like arbitrary code execution. This makes it a high-impact vulnerability for services that cannot afford downtime due to processing errors in input data.
This issue aligns with CWE-675, which describes operations on multiple resources with insufficient synchronization or uncontrolled recursion, and falls under the MITRE ATT&CK technique of T1499, Endpoint Denial of Service. The lack of depth limiting or iteration controls in the replaceAsmInstructions() function allows an attacker to exhaust system resources simply by crafting a class file with specific structural characteristics. It highlights the importance of validating input complexity and implementing safeguards against excessive recursion in libraries that handle low-level binary data transformations.
To mitigate this vulnerability, organizations must upgrade their OW2 ASM dependencies to version 9.11 or later, where the issue has been resolved through improved handling of recursive calls and better management of stack depth during bytecode generation. Additionally, developers should implement input validation mechanisms when processing external class files, ensuring that only well-formed and expected structures are passed to transformation routines. Monitoring for StackOverflowError exceptions in production environments can also serve as an early detection mechanism for potential exploitation attempts before they cause widespread service disruption.