Bug#1151198: asm: CVE-2026-110257 CVE-2026-110258 CVE-2026-110259 CVE-2026-110260 CVE-2026-110261 CVE-2026-110262 CVE-2026-110263 CVE-2026-110270 CVE-2026-110591

[Salvatore Bonaccorso]

Source: asm
Version: 9.10.1-1
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerabilities were published for asm.

CVE-2026-110257[0]:
| OW2 ASM 5.0 before 9.11 contains an excessive memory allocation
| vulnerability in ClassReader.readBootstrapMethodsAttribute() that
| sizes an int array from num_bootstrap_methods without validating
| attribute_length. Attackers can supply a crafted class file of about
| 100 bytes that forces roughly 2 GB allocation, causing an
| OutOfMemoryError that crashes the JVM or consuming thread.


CVE-2026-110258[1]:
| OW2 ASM 3.0 before 9.11 contains an excessive memory allocation
| vulnerability in Label.addSubroutineRetSuccessors() that fails to
| enforce the single-RET-per-JSR rule. Attackers can supply a crafted
| invalid class file with multiple RET instructions for one JSR,
| triggering a roughly 2 GB allocation that crashes the JVM.


CVE-2026-110259[2]:
| OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion
| vulnerability in ClassWriter.replaceAsmInstructions() that allows
| attackers to cause denial of service through crafted class files.
| Attackers can supply a class with a large method containing many
| long forward jumps, triggering unbounded toByteArray() recursion and
| a StackOverflowError during transformation.


CVE-2026-110260[3]:
| OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation
| vulnerability in MethodWriter.computeMaxStackAndLocal() and
| computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES.
| Attackers can supply a crafted class file with thousands of
| overlapping exception handlers, causing excessive Edge allocations
| and an OutOfMemoryError that crashes the JVM.


CVE-2026-110261[4]:
| OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability
| that allows attackers to exhaust CPU by supplying crafted class
| files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft
| methods that make the unbounded MethodWriter.computeAllFrames() fix
| point algorithm converge slowly, tying up transforming threads for
| unbounded time.


CVE-2026-110262[5]:
| OW2 ASM 3.1 before 9.11 contains an excessive memory allocation
| vulnerability in the asm-commons AdviceAdapter that allows attackers
| to exhaust memory by supplying crafted class files. Attackers can
| craft bytecode with many forward jump targets in constructors,
| causing unbounded stack copies in forwardJumpStackFrames and
| allocation of hundreds of megabytes, leading to denial of service.


CVE-2026-110263[6]:
| OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion
| vulnerability in SignatureReader.parseType() that allows attackers
| to exhaust the stack via deeply nested generic type signatures.
| Attackers can supply a crafted class file with a long Signature
| attribute containing many nested type arguments to trigger a
| StackOverflowError during class transformation, causing denial of
| service.


CVE-2026-110270[7]:
| OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation
| vulnerability in the asm-commons JSRInlinerAdapter that inlines
| JSR/RET subroutines without memory or work limits. Attackers can
| supply a crafted class file with nested subroutines to force O(2^n)
| memory allocation, causing an OutOfMemoryError that crashes the JVM.


CVE-2026-110591[8]:
| OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption
| vulnerability in Analyzer.analyze() that allows attackers to exhaust
| memory and CPU via crafted class files. Attackers can supply class
| files analysed through BasicVerifier, SimpleVerifier or
| SourceInterpreter to trigger unbounded per-instruction Frame
| allocation and fix point iterations, causing denial of service.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-110257
    https://www.cve.org/CVERecord?id=CVE-2026-110257
[1] https://security-tracker.debian.org/tracker/CVE-2026-110258
    https://www.cve.org/CVERecord?id=CVE-2026-110258
[2] https://security-tracker.debian.org/tracker/CVE-2026-110259
    https://www.cve.org/CVERecord?id=CVE-2026-110259
[3] https://security-tracker.debian.org/tracker/CVE-2026-110260
    https://www.cve.org/CVERecord?id=CVE-2026-110260
[4] https://security-tracker.debian.org/tracker/CVE-2026-110261
    https://www.cve.org/CVERecord?id=CVE-2026-110261
[5] https://security-tracker.debian.org/tracker/CVE-2026-110262
    https://www.cve.org/CVERecord?id=CVE-2026-110262
[6] https://security-tracker.debian.org/tracker/CVE-2026-110263
    https://www.cve.org/CVERecord?id=CVE-2026-110263
[7] https://security-tracker.debian.org/tracker/CVE-2026-110270
    https://www.cve.org/CVERecord?id=CVE-2026-110270
[8] https://security-tracker.debian.org/tracker/CVE-2026-110591
    https://www.cve.org/CVERecord?id=CVE-2026-110591

Regards,
Salvatore