CVE-2026-110591: Allocation of Resources Without Limits or Throttling in OW2 ASM
Description
CVE-2026-110591 is a medium severity vulnerability in OW2 ASM versions 1.4.3 up to but not including 9.11. It involves excessive resource consumption in the Analyzer.analyze() method, where attackers can supply crafted class files to cause unbounded memory and CPU usage. This leads to denial of service by exhausting system resources during class file analysis.
CVSS v4.0
Score 6.8medium
Affected software
OW2
ASM
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OW2 ASM versions >=1.4.3 and <9.11 contain a resource exhaustion vulnerability in the Analyzer.analyze() function. Attackers can craft malicious class files that, when analyzed using BasicVerifier, SimpleVerifier, or SourceInterpreter, trigger unbounded allocation of Frame objects per instruction and unbounded fix point iterations. This excessive resource consumption can exhaust memory and CPU, resulting in denial of service conditions.
Potential Impact
Successful exploitation allows an attacker with local access to supply malicious class files that cause the ASM library to consume excessive CPU and memory resources. This can lead to denial of service by making the system or application unresponsive or crashing due to resource exhaustion. There is no indication of code execution or data compromise from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid analyzing untrusted or crafted class files with the affected versions of OW2 ASM. Monitor for vendor updates regarding patches or workarounds.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T13:07:17.285Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acf92e92cdf04f6568a2e12
Added to database: 10/14/2026, 14:34:17 UTC
Last enriched: 10/14/2026, 15:19:11 UTC
Last updated: 10/14/2026, 19:00:33 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.