CVE-2026-112046

EUVD-2026-103508
OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.68%
Debian logo
Debian Releases
Debian Product
Codename
asm
bookworm
vulnerable
forky
vulnerable
sid
9.11.1-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://asm.ow2.io/versions.html
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_11/asm/src/main/java/org/objectweb/asm/Label.java#L417
https://gitlab.ow2.org/asm/asm/-/commit/4bb1a4701e7b61c2163525b987a96a8db815cb68
https://gitlab.ow2.org/asm/asm/-/merge_requests/480
https://www.vulncheck.com/advisories/ow2-asm-9.11-before-9.11.1-denial-of-service-via-infinite-loop-in-label-resolve