Red Hat Security Advisory

RHSA-2026:83847

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-10-16 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images maven3.9-3.9.16-0.4.hum1@noarch@public-hummingbird-aarch64-rpms, maven3.9-3.9.16-0.4.hum1@noarch@public-hummingbird-s390x-rpms, maven3.9-3.9.16-0.4.hum1@noarch@public-hummingbird-x86_64-rpms +4

Fixes 5 records

TI-2026-74083 CVE-2026-110263 · GHSA-9vfw-838x-23h7

Uncontrolled recursion in OW2 ASM SignatureReader enables denial of service

LOW 29

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.0017 Published 2026-10-14 Partial fix · 9.11 CWE-674

TI-2026-74081 CVE-2026-110261 · GHSA-42q2-x6j4-w994

Crafted class files exhaust CPU in OW2 ASM ClassWriter

LOW 29

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.0017 Published 2026-10-14 Partial fix · 9.11 CWE-407

TI-2026-74080 CVE-2026-110260 · GHSA-f8m6-wmrx-8vh2

Quadratic memory allocation in OW2 ASM exception handlers

LOW 29

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00176 Published 2026-10-14 Partial fix · 9.11 CWE-407

TI-2026-74078 CVE-2026-110258 · GHSA-mx28-xgjx-vqcw

Excessive memory allocation in OW2 ASM via multiple RET instructions

LOW 29

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.0017 Published 2026-10-14 Partial fix · 9.11 CWE-789

TI-2026-74077 CVE-2026-110257 · GHSA-jv96-63p8-4rfx

Excessive memory allocation in OW2 ASM via BootstrapMethods attribute

LOW 29

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.0017 Published 2026-10-14 Partial fix · 9.11 CWE-789