CVE-2026-110262 in ASM
Summary
by MITRE • 10/14/2026
OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in forwardJumpStackFrames and allocation of hundreds of megabytes, leading to denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within the OW2 ASM library prior to version 9.11 represents a critical resource exhaustion flaw located specifically within the AdviceAdapter component used for bytecode manipulation. This issue stems from an excessive memory allocation mechanism that is triggered when processing specially crafted Java class files. The core of the problem lies in how the library handles control flow structures, particularly forward jump targets found within constructor methods. When ASM processes these constructs, it attempts to manage stack frames associated with various execution paths. In normal scenarios, this process is bounded and efficient. However, due to a logical flaw in the handling of forward jumps during the analysis phase, the system fails to properly limit the number of stack frame copies generated for each jump target.
This technical deficiency results in unbounded memory consumption as the AdviceAdapter duplicates stack frames for every identified forward jump target without adequate constraints on the total volume of data allocated. An attacker can exploit this by constructing bytecode that contains a large number of forward jumps, effectively forcing the JVM to allocate hundreds of megabytes of memory during class loading or transformation operations. This behavior is not merely an inefficiency but a direct path to resource exhaustion. The vulnerability allows remote attackers who have the ability to supply arbitrary class files for processing to trigger this allocation spike, leading to significant performance degradation or complete system failure depending on the available heap space and concurrent load conditions.
From an operational perspective, the impact of this flaw is primarily categorized as a Denial of Service against services that utilize ASM for dynamic bytecode generation, instrumentation, or transformation. Applications such as application servers, APM agents, security scanners, or any middleware that parses untrusted class files are at risk. If these systems process maliciously crafted inputs without proper resource limits or sandboxing, the resulting memory spike can cause OutOfMemoryError exceptions, crash the Java Virtual Machine, or render the host system unstable by consuming all available RAM and triggering swap usage which severely degrades performance for other processes. This aligns with CWE-789: Uncontrolled Memory Allocation, where a software product allocates memory without sufficiently restricting the size or quantity of that allocation based on user input.
Furthermore, this vulnerability can be leveraged as part of a broader attack chain to achieve persistent denial of service against cloud-based infrastructure or containerized environments if resource quotas are not strictly enforced at the platform level. The exploitation does not require code execution privileges but rather access to any API endpoint or file upload mechanism that feeds data into ASM for parsing. This makes it particularly dangerous in microservices architectures where class files might be dynamically loaded based on user-provided configurations or uploaded artifacts.
To mitigate this risk, organizations must immediately upgrade the OW2 ASM library to version 9.11 or later, which includes patches addressing these unbounded allocation issues within the AdviceAdapter logic. For environments where upgrading is not immediately feasible, implementing strict resource limits at the JVM level can provide a partial defense in depth strategy. This involves configuring maximum heap sizes and utilizing garbage collection tuning parameters that aggressively reclaim memory during high-load scenarios. Additionally, deploying input validation layers or sandboxing mechanisms to restrict the complexity of bytecode structures accepted by ASM-based components can help prevent the triggering of this vulnerability. Security teams should also monitor for abnormal spikes in JVM memory usage associated with class loading activities as an indicator of potential exploitation attempts.
In terms of threat intelligence frameworks, this flaw maps to ATT&CK technique T1496: Resource Hijacking, specifically under sub-techniques involving resource exhaustion through computational complexity or allocation abuse. It also relates to CWE-20: Improper Input Validation, as the library fails to validate and bound the structural complexity of incoming bytecode before processing it for stack frame duplication. By addressing this vulnerability through timely patching and implementing robust input sanitization policies, organizations can significantly reduce their attack surface against denial-of-service attacks targeting Java-based infrastructure components that rely on ASM for bytecode analysis and transformation tasks.