Medium severity · published Oct 14, 2026
CVE-2026-110591
OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ASM · OW2
1.4.3 before 9.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110591
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110591
patch
https://gitlab.ow2.org/asm/asm/-/merge_requests/468
patch
https://gitlab.ow2.org/asm/asm/-/commit/4632a2283f1192fd0e93035661b49568a7cb8b6c
technical-description
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-analysis/src/main/java/org/objectweb/asm/tree/analysis/Analyzer.java#L150
release-notes
https://asm.ow2.io/versions.html
third-party-advisory
https://www.vulncheck.com/advisories/ow2-asm-1.4.3-before-9.11-excessive-resource-consumption-via-analyzer
More from ASM
5.5
CVE-2026-112046
OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
5.5
CVE-2026-110270
OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
5.5
CVE-2026-110263
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
5.5
CVE-2026-110261
OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES
5.5
CVE-2026-110260
OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers