The ASM library, used to read and transform Java bytecode, contains a flaw in the AdviceAdapter component that allocates an excessive amount of memory when handling class files with many forward jump targets. Crafted bytecode can force the library to repeatedly copy forwardJumpStackFrames, causing hundreds of megabytes of heap allocation. The resulting memory exhaustion leads to a denial of service by crashing or making the JVM unresponsive.

All installations of OW2 ASM 3.1 through 9.10.1, including the ASM Commons AdviceAdapter component, are affected. Java applications, build tools, dynamic instrumentation frameworks, and servers that embed ASM and process user‑supplied class files are potentially impacted.

The CVSS base score of 4.8 reflects moderate severity. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply crafted class files to a system that loads them with ASM; thus the attack vector is local or requires the ability to influence bytecode loading. Although remote exploitation is not described, the memory exhaustion can cause application failure or degraded performance, making the threat significant in environments that handle untrusted bytecode.