This vulnerability is a Denial of Service risk where an attacker can exhaust CPU resources by providing specially crafted Java class files that are processed with ASM's ClassWriter.COMPUTE_FRAMES. The flaw lies in the MethodWriter.computeAllFrames() algorithm, which can be forced to converge very slowly, causing transformation threads to become unboundedly busy. The impact is an inability for the affected application to perform normal class transformations, leading to performance degradation or service interruption, and confirming a CWE-407 type resource exhaustion flaw.

The affected product is the OW2 ASM library, version 3.0 before 9.11. Systems using the library in any context—such as build tools, bytecode manipulation frameworks, or application servers that dynamically generate or rewrite classes—could be impacted if they rely on the ClassWriter.COMPUTE_FRAMES feature.

The CVSS score of 6.8 indicates a moderate severity, and the EPSS score is not available, so the historical probability of exploitation remains uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers need to supply the crafted class files to an application using ASM; thus the attack vector is likely through any component that accepts or generates class files, which may be remote if the application exposes such functionality. Since the flaw consumes CPU, the exploit can be launched from a remote or local context where the attacker can inject class files, making it a plausible remote or user‑initiated DoS attack.