CVE-2026-110591mediumCWE-770

CVE-2026-110591: medium-severity vulnerability in OW2 ASM

OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer

Published · Updated

Follow this CVE+ Monitor ASM+ Monitor asm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.2%
OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
OW2 · ASM
Related CVEs — OW2 ASM

In the same product, most dangerous first.

CVE-2026-110260MEDIUMOW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception HandlersEPSS 0.2%CVE-2026-110270MEDIUMOW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapterEPSS 0.2%CVE-2026-110263MEDIUMOW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReaderEPSS 0.2%CVE-2026-110261MEDIUMOW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMESEPSS 0.2%CVE-2026-110259MEDIUMOW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()EPSS 0.2%CVE-2026-110258MEDIUMOW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET InstructionsEPSS 0.2%