Hi,

The following vulnerabilities were published for asm.

CVE-2026-110257[0]:
| OW2 ASM 5.0 before 9.11 contains an excessive memory allocation
| vulnerability in ClassReader.readBootstrapMethodsAttribute() that
| sizes an int array from num_bootstrap_methods without validating
| attribute_length. Attackers can supply a crafted class file of about
| 100 bytes that forces roughly 2 GB allocation, causing an
| OutOfMemoryError that crashes the JVM or consuming thread.


CVE-2026-110258[1]:
| OW2 ASM 3.0 before 9.11 contains an excessive memory allocation
| vulnerability in Label.addSubroutineRetSuccessors() that fails to
| enforce the single-RET-per-JSR rule. Attackers can supply a crafted
| invalid class file with multiple RET instructions for one JSR,
| triggering a roughly 2 GB allocation that crashes the JVM.


CVE-2026-110259[2]:
| OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion
| vulnerability in ClassWriter.replaceAsmInstructions() that allows
| attackers to cause denial of service through crafted class files.
| Attackers can supply a class with a large method containing many
| long forward jumps, triggering unbounded toByteArray() recursion and
| a StackOverflowError during transformation.


CVE-2026-110260[3]:
| OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation
| vulnerability in MethodWriter.computeMaxStackAndLocal() and
| computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES.
| Attackers can supply a crafted class file with thousands of
| overlapping exception handlers, causing excessive Edge allocations
| and an OutOfMemoryError that crashes the JVM.


CVE-2026-110261[4]:
| OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability
| that allows attackers to exhaust CPU by supplying crafted class
| files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft
| methods that make the unbounded MethodWriter.computeAllFrames() fix
| point algorithm converge slowly, tying up transforming threads for
| unbounded time.


CVE-2026-110262[5]:
| OW2 ASM 3.1 before 9.11 contains an excessive memory allocation
| vulnerability in the asm-commons AdviceAdapter that allows attackers
| to exhaust memory by supplying crafted class files. Attackers can
| craft bytecode with many forward jump targets in constructors,
| causing unbounded stack copies in forwardJumpStackFrames and
| allocation of hundreds of megabytes, leading to denial of service.


CVE-2026-110263[6]:
| OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion
| vulnerability in SignatureReader.parseType() that allows attackers
| to exhaust the stack via deeply nested generic type signatures.
| Attackers can supply a crafted class file with a long Signature
| attribute containing many nested type arguments to trigger a
| StackOverflowError during class transformation, causing denial of
| service.


CVE-2026-110270[7]:
| OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation
| vulnerability in the asm-commons JSRInlinerAdapter that inlines
| JSR/RET subroutines without memory or work limits. Attackers can
| supply a crafted class file with nested subroutines to force O(2^n)
| memory allocation, causing an OutOfMemoryError that crashes the JVM.


CVE-2026-110591[8]:
| OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption
| vulnerability in Analyzer.analyze() that allows attackers to exhaust
| memory and CPU via crafted class files. Attackers can supply class
| files analysed through BasicVerifier, SimpleVerifier or
| SourceInterpreter to trigger unbounded per-instruction Frame
| allocation and fix point iterations, causing denial of service.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-110257
https://www.cve.org/CVERecord?id=CVE-2026-110257
[1] https://security-tracker.debian.org/tracker/CVE-2026-110258
https://www.cve.org/CVERecord?id=CVE-2026-110258
[2] https://security-tracker.debian.org/tracker/CVE-2026-110259
https://www.cve.org/CVERecord?id=CVE-2026-110259
[3] https://security-tracker.debian.org/tracker/CVE-2026-110260
https://www.cve.org/CVERecord?id=CVE-2026-110260
[4] https://security-tracker.debian.org/tracker/CVE-2026-110261
https://www.cve.org/CVERecord?id=CVE-2026-110261
[5] https://security-tracker.debian.org/tracker/CVE-2026-110262
https://www.cve.org/CVERecord?id=CVE-2026-110262
[6] https://security-tracker.debian.org/tracker/CVE-2026-110263
https://www.cve.org/CVERecord?id=CVE-2026-110263
[7] https://security-tracker.debian.org/tracker/CVE-2026-110270
https://www.cve.org/CVERecord?id=CVE-2026-110270
[8] https://security-tracker.debian.org/tracker/CVE-2026-110591
https://www.cve.org/CVERecord?id=CVE-2026-110591

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
asm, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151198@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated asm package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 18 Oct 2026 19:40:35 +0200
Source: asm
Architecture: source
Version: 9.11.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 1151198
Changes:
 asm (9.11.1-1) unstable; urgency=medium
 .
   * New upstream release
     - Fixes CVE-2026-110257, CVE-2026-110258, CVE-2026-110259,
       CVE-2026-110260, CVE-2026-110261, CVE-2026-110262, CVE-2026-110263,
       CVE-2026-110270 and CVE-2026-110591 (Closes: #1151198)
     - Refreshed the patches
   * Converted debian/watch to version 5 format
   * Removed the Priority field
Checksums-Sha1:
 9f9fe4a8859f49b3486f1ed19d403de6984de310 2007 asm_9.11.1-1.dsc
 73b23b007b8736e886f1cdc8ddc6a6ea06fff3d2 640044 asm_9.11.1.orig.tar.xz
 01e0cc9ed51f567403169a3fcf1a9cb48b983b50 11156 asm_9.11.1-1.debian.tar.xz
 17fadebd82bfef9de243581127fccefbd928a540 17295 asm_9.11.1-1_source.buildinfo
Checksums-Sha256:
 c5a025cb8cb51773056f388e9965fbdef1a2a6242f354086121febaa66eb8487 2007 asm_9.11.1-1.dsc
 5d5e0e3bc8fffea9391df48011372af840557d34499871c74e0c554040f9239a 640044 asm_9.11.1.orig.tar.xz
 4778c900930a4d266210bc6e9b67338267d6a207a1b9fafd4e94247098007a79 11156 asm_9.11.1-1.debian.tar.xz
 c5732cf2e30f5c16a861b89c9c442c647784af2480997d78ea1cbfbf57ca85ea 17295 asm_9.11.1-1_source.buildinfo
Files:
 864191e386fbbca3f1c3239f1638319f 2007 java optional asm_9.11.1-1.dsc
 b293ae09e470f20e6d230f5c8ff02bd0 640044 java optional asm_9.11.1.orig.tar.xz
 097b01e33c684d31a8c6d74ea8daff7c 11156 java optional asm_9.11.1-1.debian.tar.xz
 530c4f3a4d3a301d5aaa1095739424f5 17295 java optional asm_9.11.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrVBM0SHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCs7NoQAMKfcailGaX9Yce/gTHiwpu6Aj342bS1
blzZJW7CAZJ0IVLZaK63ObPwOjqaa9ZfTmeqKTzemk1RUfUPacNxvy6ZtppxmwNO
KwSn8SNrrui3UeFqZZWqKPEjguuGh1HCYRIjWdRsaPGRQeFWKMpCT2TMonIBLoqX
Cx6wzhySSoQz6XUazUmCY4g8kY7cyOwdeLOF6YE0Z0R6aHx7RXNHoy34XWogi5lG
QydfnMmCTTxlIujOnpMgvd9lfX4g2OT0D/PbkcaCNnrNcWLTJ5G0McsDWCmRxK1g
yMEbKB2gzXf6HmcbWQM/Ed4WTuk9Z2ELdiMXyPN8ytf/0tDWzHsaPwOdmnnKFbeA
7RLypCAueyJkMZ2QbniIC0P+4ed/h/WOph+2YWXZebhq+pqneYVzX/6vwBbKJCOM
dxPPSmOrUbkkql6OuKsXaDlC7tsgFW/4MxwdOMZpbdTUZPP4RIr4ldm9fLg7a5iL
fAxWJFp3oqg4yCZZ3Xr7UcwcIbv+DmolU72akA0+H1ySRgGW2n0n1BxNDjo7BvH2
CMTS/A5MBm9pOtQixqHGitbc0WWvM5W1tlqPJE4xuLevReJQKakeqZs0tBzrfJJK
x+Yr5eQvVRmGdhWRfxDmiFp2+jJOQyAOv8wRGFOdeel85heZjrmBlGhkOqHgV8yQ
Yr2V2IOO8adH
=q343
-----END PGP SIGNATURE-----