OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service throu…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · NIST NVD

   Detected

   OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.

2. Oct 14, 2026 · NIST NVD

   Updated

   OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.

Sources

• CVE.orgVulnerability recordCVE-2026-110259

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-110259

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-110259

  OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, trig

  nvd.nist.gov

References

• Reference · asm.ow2.io
• Reference · gitlab.ow2.org
• Reference · gitlab.ow2.org
• Reference · gitlab.ow2.org
• Reference · vulncheck.com