This vulnerability is a Denial of Service risk where an attacker can exhaust CPU resources by providing specially crafted Java class files that are processed with ASM's ClassWriter.COMPUTE_FRAMES. The flaw lies in the MethodWriter.computeAllFrames() algorithm, which can be forced to converge very slowly, causing transformation threads to become unboundedly busy. The impact is an inability for the affected application to perform normal class transformations, leading to performance degradation or service interruption, and confirming a CWE-407 resource exhaustion flaw and CWE-606 input validation flaw.

The affected product is the OW2 ASM library, version 3.0 before 9.11. Systems using the library in any context—such as build tools, bytecode manipulation frameworks, or application servers that dynamically generate or rewrite classes—could be impacted if they rely on the ClassWriter.COMPUTE_FRAMES feature.

The CVSS score of 6.8 indicates a moderate severity, and the EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers need to supply the crafted class files to an application using ASM; thus the attack vector is likely through any component that accepts or generates class files, which may be remote if the application exposes such functionality. Since the flaw consumes CPU, the exploit can be launched from a remote or local context where the attacker can inject class files, making it a plausible remote or user‑initiated DoS attack. Additionally, the bug reflects a CWE-606 unchecked input scenario.