Live › vulnerability › CVE-2026-112046
Go to dashboardOW2 ASM 9.11 before 9.11.1 has an infinite loop in Label.resolve() when rewritten methods exceed 64 KB, because 16-bit forward-reference offsets truncate. An attacker who supplies crafted class files can hang ClassReader.accept() and deny service to build tools, instrumenters, agents or analyzers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run ASM 9.11 to read, transform or instrument class files that may be untrusted, such as build tools, Java agents, instrumenters and analyzers. Exposure depends on whether crafted class files can reach the parser, which the sources do not describe in detail. Teams that only use ASM 9.11.1 or later, or that never parse untrusted bytecode, can skip it.
No product ranges from the sources yet.
mvn dependency:tree | grep asm or gradle dependenciesorg.ow2.asm:asm at a version in 9.11 that is below 9.11.1org.ow2.asm to 9.11.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.
This page as .md · .json · in your agent: get_signal("CVE-2026-112046")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.