This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-110263 →
DEBIAN-CVE-2026-110263
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via...
Original description
The description as published by the source.
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
asm
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
asm
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
asm
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- advisory security-tracker.debian.org