CVE-2026-110591
OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
MEDIUM 6.8
En bref
- Source
- NVD
- EPSS
- EPSS 0.18 % · centile 7 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- VulnCheck
- Statut NVD
- Awaiting Analysis
Description
OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.
Faiblesses (CWE)
- CWE-770 — Allocation de ressources sans limite ni régulation
Références
- https://gitlab.ow2.org/asm/asm/-/merge_requests/468
- https://gitlab.ow2.org/asm/asm/-/commit/4632a2283f1192fd0e93035661b49568a7cb8b6c
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-analysis/src/main/java/org/objectweb/asm/tree/analysis/Analyzer.java#L150
- https://asm.ow2.io/versions.html
- https://www.vulncheck.com/advisories/ow2-asm-1.4.3-before-9.11-excessive-resource-consumption-via-analyzer
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | VulnCheck |
| CVSS 4.0 | MEDIUM 6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · disclosure@vulncheck.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | NVD · disclosure@vulncheck.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-101219
- GCVE · GCVE-0-2026-110591
Produits affectés
| Produit | Versions |
|---|---|
| OW2 · ASM | affected 1.4.3 < 9.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |