Denial of Service Vulnerability in OW2 ASM by OW2
CVE-2026-110261

6.8MEDIUM

Key Information:

Vendor

Ow2

Status
Asm
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110261?

A denial of service vulnerability exists in OW2 ASM versions prior to 9.11. The issue arises when attackers supply specially crafted class files processed with ClassWriter.COMPUTE_FRAMES. This manipulation allows attackers to execute methods that cause the unbounded MethodWriter.computeAllFrames() algorithm to take an excessive amount of time to converge, leading to CPU exhaustion. As a result, transforming threads can be tied up indefinitely, potentially degrading system performance and availability.

Affected Version(s)

ASM 3.0 < 9.11

References

https://gitlab.ow2.org/asm/asm/-/merge_requests/463
patch
https://gitlab.ow2.org/asm/asm/-/commit/ab68bbd2521359b7c...
patch
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric Bruneton
.