CVE-2026-110261

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in OW2 ASM via ClassWriter COMPUTE_FRAMES

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algorithm converge slowly, tying up transforming threads for unbounded time.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110261

EUVD

EUVD-2026-101215

Affected Vendors & Products

Vendor	Product	Version / Range
OW2	ASM	3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

OW2 ASM versions 3.0 through 9.10 have a denial of service vulnerability where attackers can craft class files that cause excessive CPU consumption. The issue occurs when processing these files with the ClassWriter.COMPUTE_FRAMES option, triggering a slow MethodWriter.computeAllFrames() algorithm that ties up transforming threads indefinitely.

Detection Guidance

To detect this vulnerability, check the version of OW2 ASM in use. If your system runs ASM versions 3.0 through 9.10, it is vulnerable. Inspect class files processed with ClassWriter.COMPUTE_FRAMES for unusual CPU usage patterns or prolonged processing times.

Impact Analysis

This vulnerability can cause system slowdowns or crashes by consuming excessive CPU resources. If exploited, it may disrupt services relying on ASM for class file processing, leading to degraded performance or unavailability of affected applications.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a denial of service issue in OW2 ASM library. However, if exploited in a system processing sensitive data, it could lead to service unavailability, potentially violating availability requirements in GDPR (Article 32) or HIPAA (Security Rule).

Mitigation Strategies

Upgrade OW2 ASM to version 9.11 or later immediately. This version addresses the excessive CPU consumption issue. If upgrading is not immediately possible, avoid using ClassWriter.COMPUTE_FRAMES for processing class files.

Hi! I’m here to help you understand CVE-2026-110261. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70