CVE-2026-110261: OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES
OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algorithm converge slowly, tying up transforming threads for unbounded time.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OW2 ASMto a version that resolves this vulnerability.Fixed in 9.11
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using OW2 ASM versions from 3.0 through versions before 9.11 are affected when they process attacker-controlled or otherwise untrusted class files with ClassWriter.COMPUTE_FRAMES.
What must an attacker provide to trigger the issue?
An attacker needs to supply a crafted class file containing methods that cause the MethodWriter.computeAllFrames() fix-point algorithm to converge slowly. The vulnerable application must process that class using ClassWriter.COMPUTE_FRAMES.
What is the operational impact?
Processing the crafted class can consume CPU and tie up transformation threads for unbounded time, resulting in a denial of service. The provided severity vector indicates no confidentiality or integrity impact.
What is the available remediation?
Update OW2 ASM to version 9.11 or later. The affected range is specified as versions 3.0 before 9.11.