Is CVE-2026-110260 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110260 being exploited in the wild.

How severe is CVE-2026-110260?

Medium severity, with a CVSS score of 5.5, published 14 October 2026.

Is there a fix for CVE-2026-110260?

Yes: fixed in ASM 9.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110260 attacked?

It is attacked over the network.

Am I affected by CVE-2026-110260?

Check whether you run OW2 ASM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110260: OW2 ASM quadratic memory allocation in MethodWriter

CVE-2026-110260 · Severity: medium · CVSS 5.5 · Published 2026-10-14

OW2 ASM is a bytecode engineering library used by Java applications to read and manipulate compiled Java classes. A crafted class file with thousands of overlapping exception handlers can trigger excessive memory allocation, causing an OutOfMemoryError that crashes the JVM. This denial-of-service vulnerability affects applications that process untrusted bytecode using ASM's COMPUTE_MAXS or COMPUTE_FRAMES features.

Technologies: OW2 ASM. Vendors: OW2.

Quick answers

Is CVE-2026-110260 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110260 being exploited in the wild.
How severe is CVE-2026-110260?: Medium severity, with a CVSS score of 5.5, published 14 October 2026.
Which products and versions are affected?: OW2 ASM 3.0 before 9.11.
Is there a fix for CVE-2026-110260?: Yes: fixed in ASM 9.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110260 attacked?: It is attacked over the network.
Am I affected by CVE-2026-110260?: Check whether you run OW2 ASM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ASM 9.11

Technical details

The vulnerability is a quadratic memory allocation flaw in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() methods. When processing exception handlers with the COMPUTE_MAXS or COMPUTE_FRAMES flag enabled, the code creates an Edge instance for each exception handler without deduplication, leading to O(n²) memory consumption. An attacker can supply a malicious class file to exhaust heap memory and crash the JVM.

Affected products

OW2 ASM 3.0 before 9.11

Timeline

2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.