The vulnerability is an uncontrolled recursion (CWE‑674) in the ASM library's ClassWriter.replaceAsmInstructions() method. When a specially crafted class file containing a method with many long forward jumps is processed, the library's toByteArray() recursion expands without bound, triggering a StackOverflowError that crashes the transformation engine. The result is that any application using ASM to load or transform classes can be brought to a halt, compromising availability.

The flaw exists in OW2 ASM library versions 3.0 up to 9.10.x. Software that embeds these libraries, such as build tools, Java agents, or any Java application that performs bytecode manipulation, is affected. Versions 9.11 and later include the fix.

The CVSS score of 6.8 indicates moderate severity. The EPSS score is < 1%, indicating a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The impact is confined to environments that process untrusted class files. An attacker with the ability to supply malicious class data—such as via a plugin, a compromised CI build, or an insecure class upload mechanism—can trigger a denial of service by exhausting the JVM stack during transformation.