---
id: CVE-2026-110591
title: >-
  OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption
  vulnerability in Analyzer.analyze() that allows attackers to exhaust memory
  and CPU via crafted class files
summary: >-
  OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption
  vulnerability in Analyzer.analyze() that allows attackers to exhaust memory
  and CPU via crafted class files. Attackers can supply class files analysed
  through BasicVeri…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T15:17:09.910'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110591'
references:
  - url: 'https://asm.ow2.io/versions.html'
    label: disclosure@vulncheck.com
  - url: >-
      https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-analysis/src/main/java/org/objectweb/asm/tree/analysis/Analyzer.java#L150
    label: disclosure@vulncheck.com
  - url: >-
      https://gitlab.ow2.org/asm/asm/-/commit/4632a2283f1192fd0e93035661b49568a7cb8b6c
    label: disclosure@vulncheck.com
  - url: 'https://gitlab.ow2.org/asm/asm/-/merge_requests/468'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/ow2-asm-1.4.3-before-9.11-excessive-resource-consumption-via-analyzer
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:13.999Z'
---

## Overview

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.