CVE-2026-110261: Inefficient Algorithmic Complexity in OW2 ASM

This vulnerability affects OW2 ASM, a Java bytecode manipulation framework, specifically versions from 3.0 up to 9.11. The flaw is due to an inefficient algorithmic complexity in the MethodWriter.computeAllFrames() fix point algorithm used when processing class files with ClassWriter.COMPUTE_FRAMES. Attackers can craft malicious class files with methods that cause this algorithm to converge slowly, resulting in denial of service by exhausting CPU resources and blocking transforming threads for an unbounded amount of time.

An attacker with the ability to supply crafted class files can cause a denial of service by exhausting CPU resources on the system processing these files. This can lead to performance degradation or unavailability of services relying on ASM for bytecode transformation. There is no indication of privilege escalation, data disclosure, or code execution from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or unverified class files with ClassWriter.COMPUTE_FRAMES to reduce exposure to this denial of service vulnerability.