CVE-2026-110262 OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter
Attackers can cause denial of service by supplying crafted class files that trigger excessive memory allocation in the OW2 ASM library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-110262?
CVE-2026-110262 is a medium-severity denial of service vulnerability in OW2 ASM, published on 14 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in forwardJumpStackFrames and allocation of hundreds of megabytes, leading to denial of service.
Weakness: CWE-770
Which versions are affected by CVE-2026-110262?
How do I fix CVE-2026-110262?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-110262 being exploited?
There is no known exploitation of CVE-2026-110262 in the wild and no public exploit code.
Sources
Also known as AZL-108372, AZL-108423, DEBIAN-CVE-2026-110262, GHSA-gcxg-xjc4-5v84, UBUNTU-CVE-2026-110262.