p PatchFirst

CVE-2026-110591

CVE-2026-110591 · OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.

CVSS 6.8 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • asm

    Versions
    • ≥ 1.4.3, < 9.11: Affected (custom)

    Update to 9.11

  • asm Debian:12

    Versions
    • 9.10.1-1
    • 9.11.1-1
    • 9.4-1
    • 9.5-1
    • 9.7-1
    • 9.7-2
    • 9.7.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Debian:13

    Versions
    • 9.10.1-1
    • 9.11.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Debian:14

    Versions
    • 9.10.1-1
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: < 9.11.1-1

    Update to 9.11.1-1

  • asm Ubuntu:18.04:LTS

    Versions
    • 6.0~alpha-1
    • 6.0~alpha-2
    • 6.0-1
    • 7.0-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:20.04:LTS

    Versions
    • 7.1-2
    • 7.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:22.04:LTS

    Versions
    • 9.1-1
    • 9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:24.04:LTS

    Versions
    • 9.4-1
    • 9.5-1
    • 9.6~us1-0ubuntu1
    • 9.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:26.10

    Versions
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • asm Ubuntu:26.04:LTS

    Versions
    • 9.8-1
    • 9.8-2
    • 9.9.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →