Asm
Monthly
Excessive resource consumption in OW2 ASM versions 1.4.3 through 9.10.x allows an unauthenticated local attacker to trigger a denial of service by supplying a crafted Java class file that is analyzed through Analyzer.analyze() with the BasicVerifier, SimpleVerifier, or SourceInterpreter implementations. The flaw, tracked as CWE-770, causes unbounded per-instruction Frame allocation and fix-point iteration, exhausting memory and CPU; exploitation requires the victim application to invoke the analysis path (user interaction) and is limited to availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is rated medium severity with a vendor patch available in ASM 9.11.
Denial of service in OW2 ASM versions 3.0 up to but not including 9.11 allows a crafted legacy class file with nested JSR/RET subroutines to trigger uncontrolled O(2^n) memory allocation in asm-commons JSRInlinerAdapter, crashing the JVM with OutOfMemoryError. The CVSS vector indicates no privileges required (PR:N) and user interaction, but the attack is local (AV:L) and not remotely triggerable: a victim process must process an attacker-supplied class file locally, and impact is availability-only with no code execution, data disclosure, or integrity loss. No public exploit identified at time of analysis; vendor patches are available for the affected range.
Uncontrolled recursion in OW2 ASM's SignatureReader.parseType() lets an attacker crash any application that reads or transforms a malicious Java class file, exhausting the stack with deeply nested generic type arguments in the class's Signature attribute. Versions 3.0 through 9.10.x (everything before 9.11) are affected; the flaw is availability-only, yielding at worst a StackOverflowError that kills the processing thread or service, with no confidentiality or integrity impact. Exploitation is local-vector and requires the victim application to actively ingest the crafted bytecode, for example through uploaded plugins, user-submitted classes, third-party build artifacts, or instrumentation input; there is no public exploit code identified at time of analysis and no indication of confirmed active exploitation (CISA KEV), and deployments that only ever parse trusted first-party bytecode are not realistically exposed.
Excessive memory allocation in the asm-commons AdviceAdapter of OW2 ASM (versions 3.1 through 9.10.x, fixed in 9.11) lets an attacker who can get crafted bytecode processed by a tool that uses AdviceAdapter drive the JVM into hundreds of megabytes of allocation and ultimately a denial of service. The flaw is triggered by class files whose constructors contain many forward jump targets, causing unbounded stack-frame copying in the forwardJumpStackFrames handling; exploitation is local (AV:L) and requires the victim process to be induced to ingest the malicious class file (UI:P/UI:R), with impact limited to availability (VA:L) and no confidentiality or integrity effect. No confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis, and the vendor has released a fix, so this is a genuine-but-modest-priority issue rather than a high-severity emergency.
CPU exhaustion in the OW2 ASM Java bytecode library (versions 3.0 through 9.10.x) lets attackers who can supply crafted class files stall bytecode-transforming threads for an unbounded amount of time whenever ClassWriter is used with the COMPUTE_FRAMES option. The crafted methods force the fix-point algorithm in MethodWriter.computeAllFrames() to converge very slowly, consuming CPU indefinitely; only availability is affected, with no confidentiality or integrity impact. The attack path is local and requires passive user interaction (a user or application must feed the crafted file into the ASM transformation call path), so exposure is limited to deployments that recompute frames on untrusted or externally influenced bytecode. Patch available per the vendor advisory, and no public exploit identified at time of analysis.
Denial of service in OW2 ASM versions 3.0 through 9.10.x allows a crafted class file to exhaust JVM heap memory when an application analyzes untrusted bytecode with the ClassWriter COMPUTE_MAXS or COMPUTE_FRAMES option enabled. A malicious class containing thousands of overlapping exception handlers triggers quadratic Edge allocation inside MethodWriter.computeMaxStackAndLocal() and computeAllFrames(), producing an OutOfMemoryError that crashes the JVM. The vendor scores this CVSS 4.0 6.8 (AV:L, PR:N, UI:P) with high availability impact only, and no public exploit or confirmed in-the-wild exploitation has been identified; the attack is bounded by the requirement that the victim application load attacker-controlled bytecode through ASM's frame-computation path.
Denial of service in OW2 ASM versions 3.0 through 9.10.x (prior to 9.11) allows an attacker to crash applications that transform untrusted Java class files by supplying a class with a large method containing many long forward jumps, which triggers unbounded recursion in ClassWriter.replaceAsmInstructions() and a StackOverflowError during toByteArray(). The issue is rated moderate severity (CVSS 6.8) and requires the target application to process attacker-controlled bytecode through ClassWriter's transformation path; no public exploit code or active exploitation has been identified, and a vendor patch is available in ASM 9.11. The attack vector is local and requires passive user interaction, with impact limited to availability.
Denial of service in OW2 ASM (versions 3.0 up to but not including 9.11) allows an attacker who can get a crafted Java class file into the library's bytecode parsing pipeline to trigger a roughly 2 GB heap allocation that crashes the JVM. The root cause is that Label.addSubroutineRetSuccessors() fails to enforce ASM's single-RET-per-JSR invariant, so a malformed class file containing multiple RET instructions for one JSR expands the successor set to an enormous size (CWE-789, excessive memory allocation). Impact is availability-only - no code execution or data disclosure - and exploitation requires an application that hands untrusted class files to ASM and reaches the legacy JSR/RET parsing path; the vendor CVSS 4.0 base score is 6.8 (AV:L, UI:P, PR:N), and the independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. medium severity and availability-only. No public exploit identified at time of analysis, and there is no evidence of active exploitation.
Denial of service in OW2 ASM 5.0 through 9.10.x allows an attacker who can supply a crafted Java class file to trigger excessive memory allocation while ClassReader parses a BootstrapMethods attribute, causing an OutOfMemoryError that crashes the JVM or the consuming thread. This is a pure availability issue (CVSS 6.8, CWE-789) with no code execution, data disclosure, or integrity impact, and it requires the victim application to parse untrusted bytecode (PR:N, UI:P/UI:R). No public exploit was identified at time of analysis; a vendor patch is available.
Excessive resource consumption in OW2 ASM versions 1.4.3 through 9.10.x allows an unauthenticated local attacker to trigger a denial of service by supplying a crafted Java class file that is analyzed through Analyzer.analyze() with the BasicVerifier, SimpleVerifier, or SourceInterpreter implementations. The flaw, tracked as CWE-770, causes unbounded per-instruction Frame allocation and fix-point iteration, exhausting memory and CPU; exploitation requires the victim application to invoke the analysis path (user interaction) and is limited to availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is rated medium severity with a vendor patch available in ASM 9.11.
Denial of service in OW2 ASM versions 3.0 up to but not including 9.11 allows a crafted legacy class file with nested JSR/RET subroutines to trigger uncontrolled O(2^n) memory allocation in asm-commons JSRInlinerAdapter, crashing the JVM with OutOfMemoryError. The CVSS vector indicates no privileges required (PR:N) and user interaction, but the attack is local (AV:L) and not remotely triggerable: a victim process must process an attacker-supplied class file locally, and impact is availability-only with no code execution, data disclosure, or integrity loss. No public exploit identified at time of analysis; vendor patches are available for the affected range.
Uncontrolled recursion in OW2 ASM's SignatureReader.parseType() lets an attacker crash any application that reads or transforms a malicious Java class file, exhausting the stack with deeply nested generic type arguments in the class's Signature attribute. Versions 3.0 through 9.10.x (everything before 9.11) are affected; the flaw is availability-only, yielding at worst a StackOverflowError that kills the processing thread or service, with no confidentiality or integrity impact. Exploitation is local-vector and requires the victim application to actively ingest the crafted bytecode, for example through uploaded plugins, user-submitted classes, third-party build artifacts, or instrumentation input; there is no public exploit code identified at time of analysis and no indication of confirmed active exploitation (CISA KEV), and deployments that only ever parse trusted first-party bytecode are not realistically exposed.
Excessive memory allocation in the asm-commons AdviceAdapter of OW2 ASM (versions 3.1 through 9.10.x, fixed in 9.11) lets an attacker who can get crafted bytecode processed by a tool that uses AdviceAdapter drive the JVM into hundreds of megabytes of allocation and ultimately a denial of service. The flaw is triggered by class files whose constructors contain many forward jump targets, causing unbounded stack-frame copying in the forwardJumpStackFrames handling; exploitation is local (AV:L) and requires the victim process to be induced to ingest the malicious class file (UI:P/UI:R), with impact limited to availability (VA:L) and no confidentiality or integrity effect. No confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis, and the vendor has released a fix, so this is a genuine-but-modest-priority issue rather than a high-severity emergency.
CPU exhaustion in the OW2 ASM Java bytecode library (versions 3.0 through 9.10.x) lets attackers who can supply crafted class files stall bytecode-transforming threads for an unbounded amount of time whenever ClassWriter is used with the COMPUTE_FRAMES option. The crafted methods force the fix-point algorithm in MethodWriter.computeAllFrames() to converge very slowly, consuming CPU indefinitely; only availability is affected, with no confidentiality or integrity impact. The attack path is local and requires passive user interaction (a user or application must feed the crafted file into the ASM transformation call path), so exposure is limited to deployments that recompute frames on untrusted or externally influenced bytecode. Patch available per the vendor advisory, and no public exploit identified at time of analysis.
Denial of service in OW2 ASM versions 3.0 through 9.10.x allows a crafted class file to exhaust JVM heap memory when an application analyzes untrusted bytecode with the ClassWriter COMPUTE_MAXS or COMPUTE_FRAMES option enabled. A malicious class containing thousands of overlapping exception handlers triggers quadratic Edge allocation inside MethodWriter.computeMaxStackAndLocal() and computeAllFrames(), producing an OutOfMemoryError that crashes the JVM. The vendor scores this CVSS 4.0 6.8 (AV:L, PR:N, UI:P) with high availability impact only, and no public exploit or confirmed in-the-wild exploitation has been identified; the attack is bounded by the requirement that the victim application load attacker-controlled bytecode through ASM's frame-computation path.
Denial of service in OW2 ASM versions 3.0 through 9.10.x (prior to 9.11) allows an attacker to crash applications that transform untrusted Java class files by supplying a class with a large method containing many long forward jumps, which triggers unbounded recursion in ClassWriter.replaceAsmInstructions() and a StackOverflowError during toByteArray(). The issue is rated moderate severity (CVSS 6.8) and requires the target application to process attacker-controlled bytecode through ClassWriter's transformation path; no public exploit code or active exploitation has been identified, and a vendor patch is available in ASM 9.11. The attack vector is local and requires passive user interaction, with impact limited to availability.
Denial of service in OW2 ASM (versions 3.0 up to but not including 9.11) allows an attacker who can get a crafted Java class file into the library's bytecode parsing pipeline to trigger a roughly 2 GB heap allocation that crashes the JVM. The root cause is that Label.addSubroutineRetSuccessors() fails to enforce ASM's single-RET-per-JSR invariant, so a malformed class file containing multiple RET instructions for one JSR expands the successor set to an enormous size (CWE-789, excessive memory allocation). Impact is availability-only - no code execution or data disclosure - and exploitation requires an application that hands untrusted class files to ASM and reaches the legacy JSR/RET parsing path; the vendor CVSS 4.0 base score is 6.8 (AV:L, UI:P, PR:N), and the independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. medium severity and availability-only. No public exploit identified at time of analysis, and there is no evidence of active exploitation.
Denial of service in OW2 ASM 5.0 through 9.10.x allows an attacker who can supply a crafted Java class file to trigger excessive memory allocation while ClassReader parses a BootstrapMethods attribute, causing an OutOfMemoryError that crashes the JVM or the consuming thread. This is a pure availability issue (CVSS 6.8, CWE-789) with no code execution, data disclosure, or integrity impact, and it requires the victim application to parse untrusted bytecode (PR:N, UI:P/UI:R). No public exploit was identified at time of analysis; a vendor patch is available.