CVE-2026-110261
Public on 2026-10-14
Modified on 2026-10-20
Description
OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algorithm converge slowly, tying up transforming threads for unbounded time.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2023 | bsh | Not Affected | ||
| Amazon Linux 2027 Preview | bsh | Not Affected | ||
| Amazon Linux 2 - Core | byteman | Pending Fix | ||
| Amazon Linux 2023 | byteman | Pending Fix | ||
| Amazon Linux 2027 Preview | byteman | Pending Fix | ||
| Amazon Linux 2023 | javapackages-bootstrap | Pending Fix | ||
| Amazon Linux 2027 Preview | javapackages-bootstrap | Pending Fix | ||
| Amazon Linux 2 - Core | objectweb-asm | Pending Fix | ||
| Amazon Linux 2023 | objectweb-asm | Pending Fix | ||
| Amazon Linux 2027 Preview | objectweb-asm | Pending Fix | ||
| Amazon Linux 2 - Core | objectweb-asm4 | Pending Fix | ||
| Amazon Linux 2023 | sisu | Pending Fix | ||
| Amazon Linux 2027 Preview | sisu | Pending Fix |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |