CVE-2026-110591: OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OW2 ASMto a version that resolves this vulnerability.Fixed in 9.11
Event History
Frequently Asked Questions
Which code paths are exposed to this issue?
The issue is triggered when class files are analyzed through BasicVerifier, SimpleVerifier, or SourceInterpreter, which use Analyzer.analyze().
What level of attacker access is needed to trigger the denial of service?
An attacker needs to be able to supply a crafted class file to an affected analysis workflow. The supplied file must then be processed by one of the affected analyzers.
What is the expected impact of successful exploitation?
Processing the crafted class file can cause unbounded per-instruction Frame allocation and fix-point iterations. This can exhaust memory and CPU resources, resulting in denial of service.