What’s Vulnerable › Vulnerabilities

CVE-2026-112046: OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-18 · updated 2026-10-19
• Weakness: CWE-835

Description

OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.

Affected products

• OW2 ASM: from 9.11 before 9.11.1 — fixed in 9.11.1

How to fix

Upgrade to a fixed version: OW2 ASM 9.11.1. Check the vendor advisory for mitigations.

References

• https://asm.ow2.io/versions.html
• https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_11/asm/src/main/java/org/objectweb/asm/Label.java#L417
• https://gitlab.ow2.org/asm/asm/-/commit/4bb1a4701e7b61c2163525b987a96a8db815cb68
• https://gitlab.ow2.org/asm/asm/-/merge_requests/480
• https://www.vulncheck.com/advisories/ow2-asm-9.11-before-9.11.1-denial-of-service-via-infinite-loop-in-label-resolve

Get alerted when CVE-2026-112046 or the next vulnerability affects your stack