CVE-2026-110257: OW2 ASM: crafted class file triggers 2GB allocation DoS

MEDIUM

Published October 14, 2026

CISO Take

OW2 ASM, a widely embedded Java bytecode library, has a flaw in ClassReader.readBootstrapMethodsAttribute() where a roughly 100-byte crafted class file forces about a 2 GB array allocation and crashes the JVM with an OutOfMemoryError. Severity is medium (CVSS 5.5, local vector, user interaction required, availability impact only), with no EPSS score, no CISA KEV listing, no public exploit and no Nuclei template, so near-term exploitation likelihood looks low. The AI relevance is indirect: ASM is a transitive dependency of many JVM build, instrumentation and data-processing tools, and our catalog shows no downstream dependent data or confirmed AI package affected. Upgrade to ASM 9.11 or later, and prioritize JVM services that parse untrusted class or JAR files, such as plugin loaders, scanners and analysis pipelines.

Sources:NVDATLASVulnCheck advisoryOW2 ASM GitLab

What is the risk?

Low to medium. The impact is limited to availability (CVSS A:H, C:N, I:N). Exploitation requires a crafted class file to be processed locally, with user interaction. There is no EPSS data, no KEV listing, no public exploit and no scanner template. Risk rises only where an AI/ML Java service ingests untrusted JARs or class files, for example model-serving plugins, Spark or Hadoop jobs with user-supplied code, or bytecode-instrumenting agents.

How does the attack unfold?

Initial Access

The attacker delivers a roughly 100-byte crafted class file or JAR to a JVM service that parses untrusted bytecode.

AML.T0010.001

Exploitation

ClassReader.readBootstrapMethodsAttribute() sizes an int array from num_bootstrap_methods without checking attribute_length and allocates about 2 GB.

Impact

The OutOfMemoryError crashes the JVM or consuming thread, interrupting the ML pipeline or serving workload.

AML.T0029

Initial Access

The attacker delivers a roughly 100-byte crafted class file or JAR to a JVM service that parses untrusted bytecode.

AML.T0010.001

Exploitation

ClassReader.readBootstrapMethodsAttribute() sizes an int array from num_bootstrap_methods without checking attribute_length and allocates about 2 GB.

Impact

The OutOfMemoryError crashes the JVM or consuming thread, interrupting the ML pipeline or serving workload.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
ASM	—	—	No patch

Do you use ASM? You're affected.

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVLocal

ACLow

PRNone

UIRequired

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade ASM to 9.11 or later and rebuild shaded or fat JARs that bundle ASM, since fixing the declared dependency alone will not patch repackaged copies. 2) Inventory transitive use with an SBOM or dependency scan (for example mvn dependency:tree or Gradle dependencies) for org.ow2.asm:asm. 3) Do not feed untrusted class or JAR files to bytecode-processing components, and validate their provenance and size first. 4) Set JVM heap limits (-Xmx), container memory limits and automatic restart so an OOM cannot cascade. 5) Alert on repeated OutOfMemoryError events in ClassReader stack frames.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSFrameworkAML.T0010.001- AI Software AML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from unknown risks and incidents

Frequently Asked Questions

What is CVE-2026-110257?

Is CVE-2026-110257 actively exploited?

No confirmed active exploitation of CVE-2026-110257 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110257?

1) Upgrade ASM to 9.11 or later and rebuild shaded or fat JARs that bundle ASM, since fixing the declared dependency alone will not patch repackaged copies. 2) Inventory transitive use with an SBOM or dependency scan (for example mvn dependency:tree or Gradle dependencies) for org.ow2.asm:asm. 3) Do not feed untrusted class or JAR files to bytecode-processing components, and validate their provenance and size first. 4) Set JVM heap limits (-Xmx), container memory limits and automatic restart so an OOM cannot cascade. 5) Alert on repeated OutOfMemoryError events in ClassReader stack frames.

What systems are affected by CVE-2026-110257?

This vulnerability affects the following AI/ML architecture patterns: JVM-based data processing pipelines, Model serving gateways with plugin loading, Build and CI pipelines for Java ML components, Bytecode instrumentation and analysis tooling.

What is the CVSS score for CVE-2026-110257?

CVE-2026-110257 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

JVM-based data processing pipelinesModel serving gateways with plugin loadingBuild and CI pipelines for Java ML componentsBytecode instrumentation and analysis tooling

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0029Denial of AI Service

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB allocation, causing an OutOfMemoryError that crashes the JVM or consuming thread.

Exploitation Scenario

An attacker plants a roughly 100-byte malformed class file, or a JAR containing one, in a location processed by a JVM-based ML data pipeline or plugin loader, for example a user-supplied UDF bundle or an uploaded extension for a Java-based analytics or model-serving service. When the service scans or instruments the file with a vulnerable ASM ClassReader, it tries to allocate about 2 GB, throws an OutOfMemoryError and crashes the JVM or worker thread. Repeating the submission keeps the pipeline or serving tier unavailable.

Weaknesses (CWE)

CWE-789Memory Allocation with Excessive Size Value

CWE-789 — Memory Allocation with Excessive Size Value: The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

[Implementation, Architecture and Design] Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
[Operation] Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.

Source: MITRE CWE corpus.