CVE-2026-110257 OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute
Attackers can crash the JVM or consuming thread by supplying a crafted class file that triggers excessive memory allocation in the ASM library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-110257?
CVE-2026-110257 is a medium-severity denial of service vulnerability in OW2 ASM, published on 14 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB allocation, causing an OutOfMemoryError that crashes the JVM or consuming thread.
Weakness: CWE-789
Which versions are affected by CVE-2026-110257?
How do I fix CVE-2026-110257?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-110257 being exploited?
There is no known exploitation of CVE-2026-110257 in the wild and no public exploit code.
Sources
Also known as AZL-108378, AZL-108426, DEBIAN-CVE-2026-110257, GHSA-jv96-63p8-4rfx, UBUNTU-CVE-2026-110257.