What’s Vulnerable › Vulnerabilities

CVE-2026-110591: OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-20
• Weakness: CWE-770

Description

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.

Affected products

• OW2 ASM: from 1.4.3 before 9.11 — fixed in 9.11

How to fix

Upgrade to a fixed version: OW2 ASM 9.11. Check the vendor advisory for mitigations.

References

• https://asm.ow2.io/versions.html
• https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-analysis/src/main/java/org/objectweb/asm/tree/analysis/Analyzer.java#L150
• https://gitlab.ow2.org/asm/asm/-/commit/4632a2283f1192fd0e93035661b49568a7cb8b6c
• https://gitlab.ow2.org/asm/asm/-/merge_requests/468
• https://www.vulncheck.com/advisories/ow2-asm-1.4.3-before-9.11-excessive-resource-consumption-via-analyzer

Get alerted when CVE-2026-110591 or the next vulnerability affects your stack