OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer (OW2 ASM)

CVE-2026-110591

MEDIUM 6.8

At a glance

Source: NVD
EPSS: EPSS 0.18 % · percentile 7 (2026-10-29)
State: PUBLISHED
Published: 2026-10-14 14:16 UTC
Updated: 2026-10-20 01:01 UTC
Assigner: VulnCheck
NVD status: Awaiting Analysis

Search on…

Description

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.

Weaknesses (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

Scores

Version	Score	Vector	Scored by
CVSS 4.0	MEDIUM 6.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	VulnCheck
CVSS 4.0	MEDIUM 6.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	NVD · disclosure@vulncheck.com (Secondary)

European references

ENISA EUVD · EUVD-2026-101219
GCVE · GCVE-0-2026-110591

Affected products

Product	Versions
OW2 · ASM	affected 1.4.3 < 9.11

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer (OW2 ASM)