Excessive Resource Consumption in OW2 ASM Product
CVE-2026-110591

6.8MEDIUM

Key Information:

Vendor

Ow2

Status
Asm
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110591?

The OW2 ASM product version 1.4.3 prior to 9.11 contains a vulnerability in the Analyzer.analyze() function that allows attackers to cause significant exhaustion of system resources, leading to potential denial of service. By submitting specially crafted class files that are processed via BasicVerifier, SimpleVerifier, or SourceInterpreter, attackers can initiate unbounded allocation of frames per instruction. This results in an excessive consumption of CPU and memory resources, which may disrupt service availability. It's essential for users of affected versions to apply the necessary patches and updates to mitigate this risk.

Affected Version(s)

ASM 1.4.3 < 9.11

References

https://gitlab.ow2.org/asm/asm/-/merge_requests/468
patch
https://gitlab.ow2.org/asm/asm/-/commit/4632a2283f1192fd0...
patch
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-anal...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric Bruneton
.