CVE-2026-110261
OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES
OW2 ASM
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 9.11ASMCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algorithm converge slowly, tying up transforming threads for unbounded time.
Text from CVE List
Affected versions 1
- ASMaffected: 3.0 before 9.11CVE List
References 5
- gitlab.ow2.org/asm/asm/-/merge_requests/463Fixvia CVE List
- gitlab.ow2.org/asm/asm/-/commit/ab68bbd2521359b7c8cd3517c6331ced3d817ed0Fixvia CVE List
- vulncheck.com/advisories/ow2-asm-3.0-before-9.11-excessive-cpu-consumption-via-classwriter-compute-framesAdvisoryvia CVE List
- gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/MethodWriter.java#L1595Referencevia CVE List
- asm.ow2.io/versions.htmlReferencevia CVE List