OW2 ASM contains an excessive memory allocation flaw in ClassReader.readBootstrapMethodsAttribute() that allocates an integer array based on num_bootstrap_methods without verifying attribute_length. A crafted class file of roughly 100 bytes can force the allocation of about 2 GiB, leading to an OutOfMemoryError that crashes the JVM or the consuming thread. This creates a denial‑of‑service condition for any process using ASM.

OW2 ASM versions 5.0 through 9.10.1 are affected. Applications that incorporate one of these versions to read or analyze Java class files are vulnerable.

The CVSS score is 6.8, indicating moderate severity. The EPSS score is 0.00172, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is the injection of a malicious class file into an application or JVM that uses ASM before version 9.11, which results only in resource exhaustion and application crash rather than arbitrary code execution.