This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-110591 →

DEBIAN-CVE-2026-110591

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and C...

Original description

The description as published by the source.

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 asm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 asm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 asm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org