Login Request a demo
Medium severity · published Oct 18, 2026
CVE-2026-112046
OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ASM · OW2
9.11 before 9.11.1 · source: vendor
Affected product
AS
ASM
OW2
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112046
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112046
asm.ow2.io
https://asm.ow2.io/versions.html
gitlab.ow2.org
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_11/asm/src/main/java/org/objectweb/asm/Label.java#L417
gitlab.ow2.org
https://gitlab.ow2.org/asm/asm/-/commit/4bb1a4701e7b61c2163525b987a96a8db815cb68
gitlab.ow2.org
https://gitlab.ow2.org/asm/asm/-/merge_requests/480
www.vulncheck.com
https://www.vulncheck.com/advisories/ow2-asm-9.11-before-9.11.1-denial-of-service-via-infinite-loop-in-label-resolve
More from ASM
5.5
CVE-2026-110591
OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
5.5
CVE-2026-110270
OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
5.5
CVE-2026-110263
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
5.5
CVE-2026-110261
OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES
5.5
CVE-2026-110260
OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers