Vulnerability · Published Oct 18, 2026 · Assigned by VulnCheck

CVE-2026-112046OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()

Medium 5.5

In plain English

A medium-severity infinite loop in ASM from OW2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.1%top 98.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	asm	no fix listed	DEBIAN-CVE-2026-112046
Debian:13	asm	no fix listed	DEBIAN-CVE-2026-112046
Debian:14	asm	9.11.1-1	DEBIAN-CVE-2026-112046
Ubuntu:22.04:LTS	asm	no fix listed	UBUNTU-CVE-2026-112046
Ubuntu:24.04:LTS	asm	no fix listed	UBUNTU-CVE-2026-112046
Ubuntu:26.04:LTS	asm	no fix listed	UBUNTU-CVE-2026-112046
Ubuntu:26.10	asm	no fix listed	UBUNTU-CVE-2026-112046

Affected products (as reported)

Vendor	Product	Versions
OW2	ASM	9.11 – before 9.11.1

Weakness: CWE-835 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://gitlab.ow2.org/asm/asm/-/merge_requests/480 patch
https://gitlab.ow2.org/asm/asm/-/commit/4bb1a4701e7b61c2163525b987a96a8db815cb68 patch
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_11/asm/src/main/java/org/objectweb/asm/Label.java#L417 technical-description
ASM 9.11.1 Release Notes release-notes
VulnCheck Advisory: OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve() third-party-advisory