OW2 ASM CVE-2026-110261

Exploitation requires that the target application process an attacker-supplied Java class file through ASM's ClassWriter configured with the COMPUTE_FRAMES flag, which invokes the unbounded MethodWriter.computeAllFrames() fix-point algorithm. This means the vulnerable path is only reachable in deployments that perform bytecode transformation/frame recomputation on untrusted or externally influenced class files (e.g., build/CI bytecode rewriters, instrumentation or AOP agents, class-loading sandboxes, or services that accept and transform uploaded bytecode). Limiting factors per the CVSS 4.0 vector: the attack vector is local (AV:L) and requires passive user interaction (UI:P) - a user or application must feed the crafted file into the ASM call path rather than the attacker triggering it directly over the network - and impact is confined to availability (CPU exhaustion of the transforming thread) with no confidentiality or integrity effect. Applications that do not use COMPUTE_FRAMES, or that only process trusted class files, are not realistically exposed.

This is a moderate-priority availability issue, not a critical one. The authoritative CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) describes a local attack vector with passive user interaction, no privileges, and impact limited solely to availability (VA:H; confidentiality and integrity are N) - consistent with CWE-407 (inefficient algorithmic complexity / algorithmic-complexity DoS). The score of 6.8 is driven entirely by the availability impact, not by any code-execution or data-exposure risk. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active exploitation or weaponized exploit code; exploitation status is therefore 'no public exploit identified at time of analysis.' The realistic risk is confined to environments that process untrusted/attacker-influenced Java class files through ASM's ClassWriter.COMPUTE_FRAMES path (e.g., bytecode-transformation pipelines, build tooling, instrumentation agents, or sandboxes that recompute stack map frames). The AV:L and UI:P metrics indicate the attacker cannot directly trigger this over the network against a default service - a local user or an application must feed the crafted class file into the vulnerable code path - which meaningfully limits mass, unauthenticated remote exploitation. Net: a real but contained DoS affecting a very widely embedded library; patch promptly where untrusted bytecode is processed, but it is not a drop-everything network-exploitable flaw.

An attacker submits a specially crafted Java class file to a service or tool that transforms bytecode using ASM's ClassWriter with the COMPUTE_FRAMES option (for example a bytecode-rewriting build step, an instrumentation agent, or an upload-and-transform pipeline). The crafted methods force MethodWriter.computeAllFrames()'s unbounded fix-point algorithm to converge extremely slowly, pinning the transforming thread at high CPU for an unbounded time and degrading or denying service. No public exploit code is identified at time of analysis, and the local attack vector with passive user interaction means the file must be ingested by an application that already calls the vulnerable path.