CVE-2026-112046
OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
- State
- Published
- Severity
- 6.8 Medium
- Published
- Oct 18, 2026
- Updated
- Oct 19, 2026
- Reserved
- Oct 18, 2026
Description
OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected Products
| Product | Versions |
|---|---|
ASMOW2 |
|
References
- https://gitlab.ow2.org/asm/asm/-/merge_requests/480patch
- https://gitlab.ow2.org/asm/asm/-/commit/4bb1a4701e7b61c2163525b987a96a8db815cb68patch
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_11/asm/src/main/java/org/objectweb/asm/Label.java#L417technical-description
- ASM 9.11.1 Release Notesrelease-notes
- VulnCheck Advisory: OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.