CVE-2026-110270 OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
Attackers can crash the JVM via exponential memory allocation in OW2 ASM by supplying crafted class files with nested subroutines.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-110270?
CVE-2026-110270 is a medium-severity denial of service vulnerability in OW2 ASM, published on 14 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM.
Weakness: CWE-407
Which versions are affected by CVE-2026-110270?
How do I fix CVE-2026-110270?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-110270 being exploited?
There is no known exploitation of CVE-2026-110270 in the wild and no public exploit code.
Sources
Also known as AZL-108381, AZL-108429, DEBIAN-CVE-2026-110270, GHSA-53jq-h6qp-vprp, UBUNTU-CVE-2026-110270.