medium5.5
CVE-2026-110263
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply n…
Impact
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.
Affected products
| Product | Affected versions |
|---|---|
| OW2 ASM 3.0 | before 9.11 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://asm.ow2.io/versions.html
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/signature/SignatureReader.java#L151
- https://gitlab.ow2.org/asm/asm/-/commit/8f87fc0317a4c5ee8f538bcbb641928def25dbd6
- https://gitlab.ow2.org/asm/asm/-/merge_requests/465
- https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-uncontrolled-recursion-in-signaturereader