CVE-2026-110591

Name	CVE-2026-110591
Description	OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151198

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
asm (PTS)	bookworm	9.4-1	vulnerable
	trixie	9.8-1	vulnerable
	forky, sid	9.11.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
asm	source	(unstable)	9.11.1-1			1151198

Notes

[trixie] - asm <no-dsa> (Minor issue)
https://gitlab.ow2.org/asm/asm/-/merge_requests/468
Fixed by: https://gitlab.ow2.org/asm/asm/-/commit/4632a2283f1192fd0e93035661b49568a7cb8b6c (ASM_9_11)