A quadratic memory allocation bug in OW2 ASM classes MethodWriter.computeMaxStackAndLocal() and computeAllFrames() occurs when the ASM constant COMPUTE_MAXS or COMPUTE_FRAMES is enabled. By supplying a class file that contains many overlapping exception handlers, an attacker can force ASM to allocate an excessive number of edge objects, exhausting the Java heap and triggering an OutOfMemoryError that crashes the JVM. This flaw is a memory exhaustion weakness (CWE‑407) and can be used to disrupt services that rely on ASM for bytecode manipulation.

The vulnerability affects all released versions of OW2 ASM from the 3.0 series up to, but not including, 9.11; the CVE title specifies a 3.0‑to‑before‑9.11 range. Applications that embed ASM for dynamic class loading, bytecode rewriting, or instrumentation are at risk when the default COMPUTE_MAXS or COMPUTE_FRAMES modes are enabled.

The CVSS score of 6.8 indicates a moderate severity, and the EPSS score of < 1% indicates a very low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting limited public exploitation evidence. Attackers must provide a specially crafted class file to a JVM that processes it with ASM; the description does not specify whether authentication is required. Successful exploitation results in a JVM crash, causing denial of service for the affected process but not privilege escalation or data disclosure.