OW2 ASM 3.0 through 9.10 revisions contain an uncontrolled recursion flaw within the SignatureReader.parseType() method. The flaw permits an attacker to craft a class file with a deeply nested generic type signature that forces the parser to recurse indefinitely, eventually exhausting the application’s stack and raising a StackOverflowError. The immediate consequence is a denial of service that halts the byte‑code transformation process, potentially affecting any Java application that uses ASM for class loading or instrumentation.

The vulnerability affects the OW2 ASM library versions 3.0 up through 9.10.x (any release earlier than 9.11). Systems that integrate these ASM releases for byte‑code manipulation—such as Java compilers, build tools, or runtime frameworks that rely on ASM to process class files—are susceptible. ASM 9.11 and later releases have fixed the recursion issue and are not impacted.

The CVSS score of 6.8 indicates a medium severity impact, while the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be the supply of malicious class files to any component that invokes ASM’s SignatureReader, which may be remote if the application accepts user‑supplied binaries or local if an attacker can place a crafted file in a directory read by the application. An exploit would trigger a stack overflow during byte‑code parsing, causing a denial‑of‑service condition. The lack of a publicly known active exploit reduces the immediate threat, but the vulnerability remains high risk for environments that load untrusted bytecode.