CVE-2026-110591
OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
- State
- Published
- Severity
- 6.8 Medium
- Published
- Oct 14, 2026
- Updated
- Oct 20, 2026
- Reserved
- Oct 14, 2026
Description
OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products
| Product | Versions |
|---|---|
ASMOW2 |
|
References
- https://gitlab.ow2.org/asm/asm/-/merge_requests/468patch
- https://gitlab.ow2.org/asm/asm/-/commit/4632a2283f1192fd0e93035661b49568a7cb8b6cpatch
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-analysis/src/main/java/org/objectweb/asm/tree/analysis/Analyzer.java#L150technical-description
- ASM 9.11 Release Notesrelease-notes
- VulnCheck Advisory: OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzerthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.