debian/asm vulnerabilities

Latest debian/asm CVEs

Newest publication first

1. CVE-2026-112046 OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()

   Published 2026-10-18

   Medium·CVSS 6.8

   OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassRe...

2. CVE-2026-110591 OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer

   Published 2026-10-14

   Medium·CVSS 6.8

   OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter t...

3. CVE-2026-110270 OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter

   Published 2026-10-14

   Medium·CVSS 6.8

   OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocatio...

4. CVE-2026-110263 OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader

   Published 2026-10-14

   Medium·CVSS 6.8

   OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many...

5. CVE-2026-110262 OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter

   Published 2026-10-14

   Medium·CVSS 4.8

   OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded...

6. CVE-2026-110261 OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES

   Published 2026-10-14

   Medium·CVSS 6.8

   OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algori...

7. CVE-2026-110260 OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers

   Published 2026-10-14

   Medium·CVSS 6.8

   OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, cau...

8. CVE-2026-110259 OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()

   Published 2026-10-14

   Medium·CVSS 6.8

   OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, trig...

9. CVE-2026-110258 OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions

   Published 2026-10-14

   Medium·CVSS 6.8

   OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughl...

10. CVE-2026-110257 OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute

    Published 2026-10-14

    Medium·CVSS 6.8

    OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can supply a crafted class file of about 100 bytes that f...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.