medium5.5
CVE-2026-110591
OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via cr…
Impact
OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.
Affected products
| Product | Affected versions |
|---|---|
| OW2 ASM 1.4.3 | before 9.11 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://asm.ow2.io/versions.html
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-analysis/src/main/java/org/objectweb/asm/tree/analysis/Analyzer.java#L150
- https://gitlab.ow2.org/asm/asm/-/commit/4632a2283f1192fd0e93035661b49568a7cb8b6c
- https://gitlab.ow2.org/asm/asm/-/merge_requests/468
- https://www.vulncheck.com/advisories/ow2-asm-1.4.3-before-9.11-excessive-resource-consumption-via-analyzer