OW2 ASM CVE-2026-110257

Exploitation requires an application built on OW2 ASM (versions 5.0 up to but not including 9.11) to invoke ClassReader on an attacker-controlled class file; the malicious file must carry a BootstrapMethods attribute whose num_bootstrap_methods field is inflated relative to the real attribute_length, which ASM fails to validate before allocating the int array. The practical limiting factor is that the victim process must accept and parse untrusted bytecode - applications that only process trusted, locally-generated class files are not exposed. Impact is bounded to availability: a recoverable OutOfMemoryError crashing the JVM or the parsing thread, with no code execution, data disclosure, or integrity impact.

The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 (medium) and describes a pure availability impact - no confidentiality or integrity loss - consistent with CWE-789 and the Denial Of Service classification. The locally-oriented vector plus passive user interaction (UI:P) means the condition is that the victim application must actually read an attacker-supplied class file, which sharply limits mass/automated exploitation compared to a network-unauthenticated RCE. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only strong signal is the vendor-confirmed patch and the VulnCheck advisory. Signals are largely consistent (medium severity, DoS-only, no exploitation telemetry) rather than conflicting. One caveat to verify: the vector is marked AV:L, but ASM is a library and in server deployments that accept remotely-supplied bytecode (plugin/JAR upload, remote agents) the practical attack vector could be network - defenders should assess whether their ASM-consuming application ingests untrusted class files from remote sources. Overall this is a genuine but moderate-priority availability bug, not a high-urgency widely-weaponized flaw.

An application that uses ASM to parse untrusted bytecode - such as a plugin loader, Java agent, static-analysis/obfuscation tool, or build pipeline processing uploaded JARs - receives a crafted class file of roughly 100 bytes whose BootstrapMethods attribute declares a huge num_bootstrap_methods without a matching attribute_length. When ClassReader.readBootstrapMethodsAttribute() sizes an int array from that count, it attempts a ~2 GB allocation, triggering an OutOfMemoryError that crashes the JVM or the consuming thread. No public exploit identified at time of analysis, though the trivial, well-described trigger makes reproduction straightforward.