Skip to content
OpenAdvisories
Medium RHSA-2026:83847 5 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Oct 20, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 maven3.9 0:3.9.16-0.4.hum1
Red Hat · Hardened Images 1 hummingbird:1 maven3.9-lib 0:3.9.16-0.4.hum1

Vulnerabilities 5

  • Medium 5.5
    CVE-2026-110257

    OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute

    OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can supply a crafted class file of a…

    OW2 ASM javapackages-bootstrap asm Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-110258

    OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions

    OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR…

    OW2 ASM javapackages-bootstrap asm Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-110260

    OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers

    OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping ex…

    OW2 ASM javapackages-bootstrap asm Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-110261

    OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES

    OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFram…

    OW2 ASM javapackages-bootstrap asm Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-110263

    OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader

    OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attri…

    OW2 ASM javapackages-bootstrap asm Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-110263
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-110257
  • report
    https://access.redhat.com/security/cve/CVE-2026-110260
  • report
    https://access.redhat.com/security/cve/CVE-2026-110261
  • report
    https://access.redhat.com/security/cve/CVE-2026-110258
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83847.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552305
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-110257
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-110257
  • article
    https://asm.ow2.io/versions.html
  • article
    https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/ClassReader.java#L3497
  • article
    https://gitlab.ow2.org/asm/asm/-/commit/eb5fa95bb0670eaec2ecf9b8a3a501b48e5a967c
  • article
    https://gitlab.ow2.org/asm/asm/-/merge_requests/456
  • article
    https://www.vulncheck.com/advisories/ow2-asm-5.0-before-9.11-excessive-memory-allocation-via-bootstrapmethods-attribute
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552308
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-110258
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-110258
  • article
    https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/Label.java#L568
  • article
    https://gitlab.ow2.org/asm/asm/-/commit/4dabfe0aef14f8cccb0617640a4add8fbcc4ed36
  • article
    https://gitlab.ow2.org/asm/asm/-/merge_requests/458
  • article
    https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-excessive-memory-allocation-via-multiple-ret-instructions
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552285
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-110260
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-110260
  • article
    https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/MethodWriter.java#L1662
  • article
    https://gitlab.ow2.org/asm/asm/-/commit/91057c98239d994aed5e46434e34e00d593c0daf
  • article
    https://gitlab.ow2.org/asm/asm/-/merge_requests/461
  • article
    https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-quadratic-memory-allocation-via-exception-handlers
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552253
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-110261
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-110261
  • article
    https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/MethodWriter.java#L1595
  • article
    https://gitlab.ow2.org/asm/asm/-/commit/ab68bbd2521359b7c8cd3517c6331ced3d817ed0
  • article
    https://gitlab.ow2.org/asm/asm/-/merge_requests/463
  • article
    https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-excessive-cpu-consumption-via-classwriter-compute-frames
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552264
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-110263