CVE-2026-110591

Awaiting Analysis Awaiting Analysis - Queue

Excessive Resource Consumption in OW2 ASM Analyzer

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110591

EUVD

EUVD-2026-101219

Affected Vendors & Products

Vendor	Product	Version / Range
OW2	ASM	1.4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in OW2 ASM 1.4.3 before 9.11 allows attackers to cause excessive memory and CPU consumption by submitting crafted class files. The Analyzer.analyze() method allocates too many Frame objects and performs too many fix-point iterations when processing these files through BasicVerifier, SimpleVerifier, or SourceInterpreter, leading to a denial of service.

Detection Guidance

Detecting this vulnerability requires checking if your system uses OW2 ASM versions 1.4.3 up to 9.10. Inspect installed ASM libraries and verify versions. No specific commands are provided in the context to detect active exploitation.

Impact Analysis

If you use affected OW2 ASM versions, an attacker could exploit this to crash your system by consuming all available memory and CPU resources. This would disrupt services relying on ASM for class file analysis, causing downtime or performance degradation.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling denial-of-service attacks that disrupt system availability. Resource exhaustion may lead to service unavailability, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade OW2 ASM to version 9.11 or later to address the vulnerability. If upgrading is not possible, restrict access to systems using ASM or disable the affected components BasicVerifier, SimpleVerifier, and SourceInterpreter.

Hi! I’m here to help you understand CVE-2026-110591. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70