CVE-2026-110591

MEDIUM 5.5

OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.

CWE	CWE-770
Vendor	ow2
Product	asm
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for ow2 asm

Be the first to know when new medium vulnerabilities affecting ow2 asm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

OW2 / ASM

1.4.3 < 9.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gitlab.ow2.org: https://gitlab.ow2.org/asm/asm/-/merge_requests/468 gitlab.ow2.org: https://gitlab.ow2.org/asm/asm/-/commit/4632a2283f1192fd0e93035661b49568a7cb8b6c gitlab.ow2.org: https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-analysis/src/main/java/org/objectweb/asm/tree/analysis/Analyzer.java#L150 asm.ow2.io: https://asm.ow2.io/versions.html vulncheck.com: https://www.vulncheck.com/advisories/ow2-asm-1.4.3-before-9.11-excessive-resource-consumption-via-analyzer

Credits

Eric Bruneton