{"id":"CVE-2026-112046","kind":"vulnerability","aliases":["CVE-2026-112046"],"related":[],"title":"OW2 ASM: crafted class files hang the bytecode library, denying service","description":"OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.","summary":"OW2 ASM 9.11 before 9.11.1 has an infinite loop in Label.resolve() when rewritten methods exceed 64 KB, because 16-bit forward-reference offsets truncate. An attacker who supplies crafted class files can hang ClassReader.accept() and deny service to build tools, instrumenters, agents or analyzers.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asm","build-tools","java","jvm-agents","package"],"not_affected_if":["asm-9.11.1-or-later","no-untrusted-bytecode"],"how_to_check":"- Check the ASM version in your build or dependency tree, for example `mvn dependency:tree | grep asm` or `gradle dependencies`\n- Look for `org.ow2.asm:asm` at a version in `9.11` that is below `9.11.1`","fix":"- Upgrade `org.ow2.asm` to `9.11.1` or later\n- Rebuild and redeploy services or tools that bundle ASM, including shaded or fat jars","status":"open","published_at":"2026-10-18T13:16:36+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:45:02+00:00","updated_at":"2026-10-25T03:45:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:45:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `org.ow2.asm` to `9.11.1` or later\n- Rebuild and redeploy services or tools that bundle ASM, including shaded or fat jars","reach":"unknown","title":"OW2 ASM: crafted class files hang the bytecode library, denying service","impact":"low","summary":"OW2 ASM 9.11 before 9.11.1 has an infinite loop in Label.resolve() when rewritten methods exceed 64 KB, because 16-bit forward-reference offsets truncate. An attacker who supplies crafted class files can hang ClassReader.accept() and deny service to build tools, instrumenters, agents or analyzers.","category":"package","nicknames":[],"who_cares":["java","asm","build-tools","jvm-agents"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Parsing hangs, causing denial of service in the affected process","analyst_note":"","how_to_check":"- Check the ASM version in your build or dependency tree, for example `mvn dependency:tree | grep asm` or `gradle dependencies`\n- Look for `org.ow2.asm:asm` at a version in `9.11` that is below `9.11.1`","needs_analyst":false,"not_affected_if":["asm-9.11.1-or-later","no-untrusted-bytecode"],"who_is_affected":"Systems that run ASM 9.11 to read, transform or instrument class files that may be untrusted, such as build tools, Java agents, instrumenters and analyzers. Exposure depends on whether crafted class files can reach the parser, which the sources do not describe in detail. Teams that only use ASM 9.11.1 or later, or that never parse untrusted bytecode, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000655,"input_tokens":3371,"output_tokens":635,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112046':14A,17A '-2026':13A,16A '16':45B,86C '64':42B,97C '65535':110C '9.11':29B,74C '9.11.1':31B,76C 'agent':25B,69B,121C 'analyz':71B,123C 'asm':2A,18B,28B,73C 'attack':53B,99C 'bit':46B,87C 'build':20B,66B,118C 'build-tool':19B 'byte':111C 'bytecod':8A 'caus':84C 'class':4A,57B,103C 'classreader.accept':61B,113C 'code':107C 'contain':77C 'craft':3A,56B,102C 'cve':12A,15A 'deni':10A,63B,115C 'exceed':41B,96C 'file':5A,58B,104C 'forward':48B,89C 'forward-refer':47B,88C 'grow':108C 'hang':6A,60B,112C 'infinit':34B,79C 'instrument':68B,120C 'java':22B 'jvm':24B 'jvm-agent':23B 'kb':43B,98C 'label.resolve':37B,83C 'librari':9A 'loop':35B,80C 'method':40B,95C 'offset':50B,91C 'ow2':1A,27B,72C 'packag':26B 'past':109C 'refer':49B,90C 'rewritten':39B,94C 'servic':11A,64B,116C 'suppli':55B,101C 'tool':21B,67B,119C 'transform':106C 'truncat':51B,92C 'vulner':81C 'whose':105C","nicknames":[],"mitigations":[],"who_affected":"Systems that run ASM 9.11 to read, transform or instrument class files that may be untrusted, such as build tools, Java agents, instrumenters and analyzers. Exposure depends on whether crafted class files can reach the parser, which the sources do not describe in detail. Teams that only use ASM 9.11.1 or later, or that never parse untrusted bytecode, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112046","severity":null,"published_at":"2026-10-18T13:16:36+00:00","modified_at":"2026-10-19T21:13:39+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}