CVE-2026-110261

EUVD-2026-101215
OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algorithm converge slowly, tying up transforming threads for unbounded time.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://asm.ow2.io/versions.html
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/MethodWriter.java#L1595
https://gitlab.ow2.org/asm/asm/-/commit/ab68bbd2521359b7c8cd3517c6331ced3d817ed0
https://gitlab.ow2.org/asm/asm/-/merge_requests/463
https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-excessive-cpu-consumption-via-classwriter-compute-frames