Description
OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OW2 ASM
Default version status: unaffected
3.0 to < 9.11affected
pkg:maven/org.ow2.asm/asmReferences
- https://gitlab.ow2.org/asm/asm/-/merge_requests/461 ↗
- https://gitlab.ow2.org/asm/asm/-/commit/91057c98239d994aed5e46434e34e00d593c0daf ↗
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/MethodWriter.java#L1662 ↗
- https://asm.ow2.io/versions.html ↗
- https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-quadratic-memory-allocation-via-exception-handlers ↗