OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
Summary
| CVE | CVE-2026-110591 |
|---|---|
| State | PUBLISHED |
| Assigner | VulnCheck |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-14 15:17:09 UTC |
| Updated | 2026-10-20 01:17:10 UTC |
| Description | OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service. |
Risk And Classification
Primary CVSS: v4.0 6.8 MEDIUM from [email protected]
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.001720000 probability, percentile 0.062140000 (date 2026-10-20)
Problem Types: CWE-770 | CWE-770 Allocation of Resources Without Limits or Throttling
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 6.8 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.8 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
CVSS v4.0 Breakdown
Attack Vector
LocalAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
PassiveConfidentiality
NoneIntegrity
NoneAvailability
HighSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.vulncheck.com/advisories/ow2-asm-1.4.3-before-9.11-excessive-resource-consu... | [email protected] | www.vulncheck.com | |
| gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-analysis/src/main/java/org/obje... | [email protected] | gitlab.ow2.org | |
| gitlab.ow2.org/asm/asm/-/commit/4632a2283f1192fd0e93035661b49568a7cb8b6c | [email protected] | gitlab.ow2.org | |
| asm.ow2.io/versions.html | [email protected] | asm.ow2.io | |
| gitlab.ow2.org/asm/asm/-/merge_requests/468 | [email protected] | gitlab.ow2.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Eric Bruneton (en)
There are currently no legacy QID mappings associated with this CVE.