Description
OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OW2 ASM
Default version status: unaffected
3.0 to < 9.11affected
pkg:maven/org.ow2.asm/asm-commonsReferences
- https://gitlab.ow2.org/asm/asm/-/merge_requests/466 ↗
- https://gitlab.ow2.org/asm/asm/-/commit/f2b988af48719f85a274f2a05e37bc55c0cd22a1 ↗
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-commons/src/main/java/org/objectweb/asm/commons/JSRInlinerAdapter.java#L232 ↗
- https://asm.ow2.io/versions.html ↗
- https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-exponential-memory-allocation-in-jsrinlineradapter ↗