CVE-2026-110263
MEDIUMCVSS 5.5Description
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.
Timeline
Published:October 14th, 2026 3:17 PM
Last modified:October 14th, 2026 5:18 PM
CVSS Scoring
CVSS v3: 5.5 (MEDIUM)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://asm.ow2.io/versions.html
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/signature/SignatureReader.java#L151
- https://gitlab.ow2.org/asm/asm/-/commit/8f87fc0317a4c5ee8f538bcbb641928def25dbd6
- https://gitlab.ow2.org/asm/asm/-/merge_requests/465
- https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-uncontrolled-recursion-in-signaturereader
Source: NIST NVD · Data may lag official sources by up to one minute