Source: asm Version: 9.10.1-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for asm. CVE-2026-110257[0]: | OW2 ASM 5.0 before 9.11 contains an excessive memory allocation | vulnerability in ClassReader.readBootstrapMethodsAttribute() that | sizes an int array from num_bootstrap_methods without validating | attribute_length. Attackers can supply a crafted class file of about | 100 bytes that forces roughly 2 GB allocation, causing an | OutOfMemoryError that crashes the JVM or consuming thread. CVE-2026-110258[1]: | OW2 ASM 3.0 before 9.11 contains an excessive memory allocation | vulnerability in Label.addSubroutineRetSuccessors() that fails to | enforce the single-RET-per-JSR rule. Attackers can supply a crafted | invalid class file with multiple RET instructions for one JSR, | triggering a roughly 2 GB allocation that crashes the JVM. CVE-2026-110259[2]: | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion | vulnerability in ClassWriter.replaceAsmInstructions() that allows | attackers to cause denial of service through crafted class files. | Attackers can supply a class with a large method containing many | long forward jumps, triggering unbounded toByteArray() recursion and | a StackOverflowError during transformation. CVE-2026-110260[3]: | OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation | vulnerability in MethodWriter.computeMaxStackAndLocal() and | computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. | Attackers can supply a crafted class file with thousands of | overlapping exception handlers, causing excessive Edge allocations | and an OutOfMemoryError that crashes the JVM. CVE-2026-110261[4]: | OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability | that allows attackers to exhaust CPU by supplying crafted class | files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft | methods that make the unbounded MethodWriter.computeAllFrames() fix | point algorithm converge slowly, tying up transforming threads for | unbounded time. CVE-2026-110262[5]: | OW2 ASM 3.1 before 9.11 contains an excessive memory allocation | vulnerability in the asm-commons AdviceAdapter that allows attackers | to exhaust memory by supplying crafted class files. Attackers can | craft bytecode with many forward jump targets in constructors, | causing unbounded stack copies in forwardJumpStackFrames and | allocation of hundreds of megabytes, leading to denial of service. CVE-2026-110263[6]: | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion | vulnerability in SignatureReader.parseType() that allows attackers | to exhaust the stack via deeply nested generic type signatures. | Attackers can supply a crafted class file with a long Signature | attribute containing many nested type arguments to trigger a | StackOverflowError during class transformation, causing denial of | service. CVE-2026-110270[7]: | OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation | vulnerability in the asm-commons JSRInlinerAdapter that inlines | JSR/RET subroutines without memory or work limits. Attackers can | supply a crafted class file with nested subroutines to force O(2^n) | memory allocation, causing an OutOfMemoryError that crashes the JVM. CVE-2026-110591[8]: | OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption | vulnerability in Analyzer.analyze() that allows attackers to exhaust | memory and CPU via crafted class files. Attackers can supply class | files analysed through BasicVerifier, SimpleVerifier or | SourceInterpreter to trigger unbounded per-instruction Frame | allocation and fix point iterations, causing denial of service. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-110257 https://www.cve.org/CVERecord?id=CVE-2026-110257 [1] https://security-tracker.debian.org/tracker/CVE-2026-110258 https://www.cve.org/CVERecord?id=CVE-2026-110258 [2] https://security-tracker.debian.org/tracker/CVE-2026-110259 https://www.cve.org/CVERecord?id=CVE-2026-110259 [3] https://security-tracker.debian.org/tracker/CVE-2026-110260 https://www.cve.org/CVERecord?id=CVE-2026-110260 [4] https://security-tracker.debian.org/tracker/CVE-2026-110261 https://www.cve.org/CVERecord?id=CVE-2026-110261 [5] https://security-tracker.debian.org/tracker/CVE-2026-110262 https://www.cve.org/CVERecord?id=CVE-2026-110262 [6] https://security-tracker.debian.org/tracker/CVE-2026-110263 https://www.cve.org/CVERecord?id=CVE-2026-110263 [7] https://security-tracker.debian.org/tracker/CVE-2026-110270 https://www.cve.org/CVERecord?id=CVE-2026-110270 [8] https://security-tracker.debian.org/tracker/CVE-2026-110591 https://www.cve.org/CVERecord?id=CVE-2026-110591 Regards, Salvatore
