[From nobody Sun Oct 18 19:07:06 2026 Received: (at submit) by bugs.debian.org; 18 Oct 2026 05:56:27 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-107.4 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FROMDEVELOPER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 82; hammy, 150; neutral, 112; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:47942) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xIJsh-002Ktw-07 for submit@bugs.debian.org; Sun, 18 Oct 2026 05:56:27 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=uwAQR76aK4nvpK5t2lQH8BTMei+2H5mOW9Xx01b0FKw=; b=YnvWNI1RPLSCiyDPeyUvaUdWRn VpeiNrmhzu+C+PaTB4Xmldw0wDvDAu0rSgGpT+6UNfOvFFEJM45TITh3OvJ9OqdUttgiVfBGTiI6p bhVsrltF0AVG+H94ntgaNEagfI6D3TORIwxsi40x+yRc0hs7gePFbiHshXr20X/h+oOxeTPHfoxJu K1YhWrUvMFe5saAS1S4FUa7UVBJ4wNuqsLjqNZYrFTcBJ861PqpcyVMRlwlxNDJAHhu6UProS0Jv2 Po1PObeSpXz0jejc1MaEPFkCOutkqkjuKX+vbopM/i3P1d0wXVGDDc3kIjdO+8foHaXSU6Rj2ad3V abr6LRNw==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xIJse-007Jb8-0q for submit@bugs.debian.org; Sun, 18 Oct 2026 05:56:25 +0000 Received: by eldamar.lan (Postfix, from userid 1000) id DDD68DC06B2; Sun, 18 Oct 2026 07:56:23 +0200 (CEST) Date: Sun, 18 Oct 2026 07:56:23 +0200 From: Salvatore Bonaccorso <carnil@debian.org> To: submit@bugs.debian.org Subject: asm: CVE-2026-110257 CVE-2026-110258 CVE-2026-110259 CVE-2026-110260 CVE-2026-110261 CVE-2026-110262 CVE-2026-110263 CVE-2026-110270 CVE-2026-110591 Message-ID: <atRfh1wNBzkJRZHz@eldamar.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: asm Version: 9.10.1-1 X-Debbugs-CC: team@security.debian.org Severity: important Tags: security upstream Hi, The following vulnerabilities were published for asm. CVE-2026-110257[0]: | OW2 ASM 5.0 before 9.11 contains an excessive memory allocation | vulnerability in ClassReader.readBootstrapMethodsAttribute() that | sizes an int array from num_bootstrap_methods without validating | attribute_length. Attackers can supply a crafted class file of about | 100 bytes that forces roughly 2 GB allocation, causing an | OutOfMemoryError that crashes the JVM or consuming thread. CVE-2026-110258[1]: | OW2 ASM 3.0 before 9.11 contains an excessive memory allocation | vulnerability in Label.addSubroutineRetSuccessors() that fails to | enforce the single-RET-per-JSR rule. Attackers can supply a crafted | invalid class file with multiple RET instructions for one JSR, | triggering a roughly 2 GB allocation that crashes the JVM. CVE-2026-110259[2]: | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion | vulnerability in ClassWriter.replaceAsmInstructions() that allows | attackers to cause denial of service through crafted class files. | Attackers can supply a class with a large method containing many | long forward jumps, triggering unbounded toByteArray() recursion and | a StackOverflowError during transformation. CVE-2026-110260[3]: | OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation | vulnerability in MethodWriter.computeMaxStackAndLocal() and | computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. | Attackers can supply a crafted class file with thousands of | overlapping exception handlers, causing excessive Edge allocations | and an OutOfMemoryError that crashes the JVM. CVE-2026-110261[4]: | OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability | that allows attackers to exhaust CPU by supplying crafted class | files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft | methods that make the unbounded MethodWriter.computeAllFrames() fix | point algorithm converge slowly, tying up transforming threads for | unbounded time. CVE-2026-110262[5]: | OW2 ASM 3.1 before 9.11 contains an excessive memory allocation | vulnerability in the asm-commons AdviceAdapter that allows attackers | to exhaust memory by supplying crafted class files. Attackers can | craft bytecode with many forward jump targets in constructors, | causing unbounded stack copies in forwardJumpStackFrames and | allocation of hundreds of megabytes, leading to denial of service. CVE-2026-110263[6]: | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion | vulnerability in SignatureReader.parseType() that allows attackers | to exhaust the stack via deeply nested generic type signatures. | Attackers can supply a crafted class file with a long Signature | attribute containing many nested type arguments to trigger a | StackOverflowError during class transformation, causing denial of | service. CVE-2026-110270[7]: | OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation | vulnerability in the asm-commons JSRInlinerAdapter that inlines | JSR/RET subroutines without memory or work limits. Attackers can | supply a crafted class file with nested subroutines to force O(2^n) | memory allocation, causing an OutOfMemoryError that crashes the JVM. CVE-2026-110591[8]: | OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption | vulnerability in Analyzer.analyze() that allows attackers to exhaust | memory and CPU via crafted class files. Attackers can supply class | files analysed through BasicVerifier, SimpleVerifier or | SourceInterpreter to trigger unbounded per-instruction Frame | allocation and fix point iterations, causing denial of service. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-110257 https://www.cve.org/CVERecord?id=CVE-2026-110257 [1] https://security-tracker.debian.org/tracker/CVE-2026-110258 https://www.cve.org/CVERecord?id=CVE-2026-110258 [2] https://security-tracker.debian.org/tracker/CVE-2026-110259 https://www.cve.org/CVERecord?id=CVE-2026-110259 [3] https://security-tracker.debian.org/tracker/CVE-2026-110260 https://www.cve.org/CVERecord?id=CVE-2026-110260 [4] https://security-tracker.debian.org/tracker/CVE-2026-110261 https://www.cve.org/CVERecord?id=CVE-2026-110261 [5] https://security-tracker.debian.org/tracker/CVE-2026-110262 https://www.cve.org/CVERecord?id=CVE-2026-110262 [6] https://security-tracker.debian.org/tracker/CVE-2026-110263 https://www.cve.org/CVERecord?id=CVE-2026-110263 [7] https://security-tracker.debian.org/tracker/CVE-2026-110270 https://www.cve.org/CVERecord?id=CVE-2026-110270 [8] https://security-tracker.debian.org/tracker/CVE-2026-110591 https://www.cve.org/CVERecord?id=CVE-2026-110591 Regards, Salvatore ]