The vulnerability is found in the Analyzer.analyze() method of OW2 ASM 1.4.3 through 9.10.1. It allows an attacker to supply a crafted class file that triggers unbounded per‑instruction Frame allocation and iterative fix‑point calculations during analysis. The resulting excessive memory allocation and CPU usage can exhaust the hosting process, effectively denying service. The weakness is an instance of excessive resource consumption (CWE‑770).

OW2 ASM, versions 1.4.3 to 9.10.1, are affected. The vulnerability exists in the core analysis library that is used for class verification (BasicVerifier, SimpleVerifier, SourceInterpreter). No specific deployment environment is required; any Java application that loads and analyzes class files with these verifiers is potentially impacted.

The CVSS score of 6.8 indicates moderate severity. The EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote supply of crafted class files to any process that performs ASM analysis. An attacker can simply submit a malicious class file to the target application, which will then consume excessive resources and cause a denial of service. Because the vulnerability does not require privileged execution or network access beyond class file input, the risk remains moderate but can become critical in highly available or mission‑critical environments where ASM analysis is performed on untrusted input.