org.ow2.asm:asm 9.8

Direct Vulnerabilities

Known vulnerabilities in the org.ow2.asm:asm package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Inefficient Algorithmic Complexity Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `computeAllFrames()` and `computeMaxStackAndLocal()` methods in `MethodWriter`. When ASM processes a crafted class file with thousands of overlapping exception handlers using `COMPUTE_FRAMES` or `COMPUTE_MAXS`, it allocates excessive `Edge` objects, causing an `OutOfMemoryError` that crashes the JVM. How to fix Inefficient Algorithmic Complexity? Upgrade `org.ow2.asm:asm` to version 9.11 or higher.	[3.0,9.11)
M Memory Allocation with Excessive Size Value Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the `addSubroutineRetSuccessors()` method in the `Label` class. An attacker can crash the JVM by supplying a crafted invalid class file with multiple `RET` instructions for one `JSR` while ASM processes the subroutine. Notes The attacker must get a user to load or process the crafted class file. How to fix Memory Allocation with Excessive Size Value? Upgrade `org.ow2.asm:asm` to version 9.11 or higher.	[3.0,9.11)
M Uncontrolled Recursion Affected versions of this package are vulnerable to Uncontrolled Recursion via the `parseType` method in `SignatureReader`. An attacker can trigger a `StackOverflowError` and disrupt class transformation by supplying a crafted class file with a `Signature` attribute containing deeply nested generic type arguments. How to fix Uncontrolled Recursion? Upgrade `org.ow2.asm:asm` to version 9.11 or higher.	[3.0,9.11)
M Memory Allocation with Excessive Size Value Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via `readBootstrapMethodsAttribute()` in `ClassReader`. When an application parses an attacker-supplied class file, a crafted BootstrapMethods attribute with an unchecked declared length can trigger an allocation of roughly 2 GB from a file of about 100 bytes, causing an `OutOfMemoryError` that crashes the JVM or the thread processing the class. How to fix Memory Allocation with Excessive Size Value? Upgrade `org.ow2.asm:asm` to version 9.11 or higher.	[5.0,9.11)
M Inefficient Algorithmic Complexity Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `computeAllFrames` method in `MethodWriter`. An attacker can exhaust CPU and tie up class-file transformation threads for an unbounded time by supplying crafted class files for processing with `ClassWriter.COMPUTE_FRAMES`; their methods make frame computation’s fixpoint algorithm converge slowly. How to fix Inefficient Algorithmic Complexity? Upgrade `org.ow2.asm:asm` to version 9.11 or higher.	[3.0,9.11)

Vulnerability

Vulnerable Version

Inefficient Algorithmic Complexity

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames() and computeMaxStackAndLocal() methods in MethodWriter. When ASM processes a crafted class file with thousands of overlapping exception handlers using COMPUTE_FRAMES or COMPUTE_MAXS, it allocates excessive Edge objects, causing an OutOfMemoryError that crashes the JVM.

How to fix Inefficient Algorithmic Complexity?

Upgrade org.ow2.asm:asm to version 9.11 or higher.

[3.0,9.11)

Memory Allocation with Excessive Size Value

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the addSubroutineRetSuccessors() method in the Label class. An attacker can crash the JVM by supplying a crafted invalid class file with multiple RET instructions for one JSR while ASM processes the subroutine.

Notes

The attacker must get a user to load or process the crafted class file.

How to fix Memory Allocation with Excessive Size Value?

Upgrade org.ow2.asm:asm to version 9.11 or higher.

[3.0,9.11)

Uncontrolled Recursion

Affected versions of this package are vulnerable to Uncontrolled Recursion via the parseType method in SignatureReader. An attacker can trigger a StackOverflowError and disrupt class transformation by supplying a crafted class file with a Signature attribute containing deeply nested generic type arguments.

How to fix Uncontrolled Recursion?

Upgrade org.ow2.asm:asm to version 9.11 or higher.

[3.0,9.11)

Memory Allocation with Excessive Size Value

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via readBootstrapMethodsAttribute() in ClassReader. When an application parses an attacker-supplied class file, a crafted BootstrapMethods attribute with an unchecked declared length can trigger an allocation of roughly 2 GB from a file of about 100 bytes, causing an OutOfMemoryError that crashes the JVM or the thread processing the class.

How to fix Memory Allocation with Excessive Size Value?

Upgrade org.ow2.asm:asm to version 9.11 or higher.

[5.0,9.11)

Inefficient Algorithmic Complexity

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames method in MethodWriter. An attacker can exhaust CPU and tie up class-file transformation threads for an unbounded time by supplying crafted class files for processing with ClassWriter.COMPUTE_FRAMES; their methods make frame computation’s fixpoint algorithm converge slowly.

How to fix Inefficient Algorithmic Complexity?

Upgrade org.ow2.asm:asm to version 9.11 or higher.

[3.0,9.11)

org.ow2.asm:asm@9.8

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically