OW2 ASM EUVD-2026-101217

Exploitation requires that a vulnerable ASM version (3.0 up to but not including 9.11) read or transform an attacker-crafted Java class file whose Signature attribute contains many levels of nested generic type arguments, driving SignatureReader.parseType() into unbounded recursion. The concrete prerequisite is that ASM processes untrusted or externally supplied bytecode (e.g., uploaded plugins, user-submitted classes, build artifacts, instrumentation agents). Limiting factors: the CVSS vector is Local (AV:L) with passive user interaction (UI:P), meaning the victim application must actively ingest and parse the malicious class; impact is confined to availability (VA:H) with no confidentiality or integrity effect, so the worst case is a crash/DoS of the processing thread or service, not code execution or data loss. Deployments that only ever process trusted, first-party bytecode are not realistically exposed.

This is a moderate, availability-only issue rather than a top-tier priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VA:H, confidentiality and integrity N) correctly frames it as a local, passive-user-interaction denial of service with no data exposure or code execution - consistent with the CWE-674 uncontrolled-recursion root cause and the description's StackOverflowError outcome. The score of 6.8 is driven entirely by the availability impact; there is no privilege escalation or RCE path. Exploitation status: no public exploit identified at time of analysis - the CVE is not in CISA KEV and no POC is referenced, so there is no evidence of active or automated exploitation. EPSS and SSVC data were not provided in the input and therefore cannot be factored in. The key caveat is the attack vector: the vendor set AV:L, but ASM is a library that frequently transforms class files arriving from external or untrusted sources (uploads, plugins, build artifacts, deserialized bytecode). In deployments where attacker-controlled class files reach ASM over a network boundary, the real-world reachability is effectively remote even though the base metric is Local - verify how untrusted class input reaches ASM in your environment. Net: a real but bounded DoS best triaged as medium priority, patched on a normal cadence unless ASM processes attacker-supplied bytecode in a critical service.

An attacker supplies a crafted Java class file whose Signature attribute contains deeply nested generic type arguments. When an application or tool uses a vulnerable ASM version (3.0 to before 9.11) to read or transform that class, SignatureReader.parseType() recurses without bound and throws a StackOverflowError, crashing the processing thread or service. No public exploit code is referenced, but the crafted-input requirement is trivial to satisfy for anyone who can feed bytecode into an ASM-based pipeline.