CVE-2026-110591

medium

Description

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.

References

https://www.vulncheck.com/advisories/ow2-asm-1.4.3-before-9.11-excessive-resource-consumption-via-analyzer

https://gitlab.ow2.org/asm/asm/-/merge_requests/468

https://gitlab.ow2.org/asm/asm/-/commit/4632a2283f1192fd0e93035661b49568a7cb8b6c

https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-analysis/src/main/java/org/objectweb/asm/tree/analysis/Analyzer.java#L150

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101219

https://asm.ow2.io/versions.html

Details

Source: Mitre, NVD

Published: 2026-10-14

Updated: 2026-10-16

Risk Information

CVSS v2

Base Score: 4.9

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

Severity: Medium

CVSS v3

Base Score: 5.5

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Severity: Medium

CVSS v4

Base Score: 6.8

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00172