CVE-2026-110257
Description
A flaw was found in OW2 ASM. An attacker can cause a Denial of Service (DoS) by providing a specially crafted Java class file. Due to missing attribute length validation during class parsing, processing the file triggers excessive memory allocation, exhausting system resources and crashing the application or the Java Virtual Machine (JVM).
Statement
This vulnerability is rated as Moderate impact because triggering the condition requires an application or build tool to parse untrusted Java bytecode, limiting the blast radius to a denial of service without compromising data confidentiality or system integrity. In Red Hat environments, ASM is predominantly embedded in developer tooling and middleware frameworks where class analysis is performed on trusted libraries and artifacts. Consequently, remote or unauthenticated exploitation in standard deployments is unlikely unless an application explicitly parses arbitrary bytecode supplied by untrusted users.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 5.5 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
