---
id: "CVE-2026-112046"
kind: "vulnerability"
aliases: ["CVE-2026-112046"]
title: "OW2 ASM: crafted class files hang the bytecode library, denying service"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["asm", "build-tools", "java", "jvm-agents", "package"]
not_affected_if: ["asm-9.11.1-or-later", "no-untrusted-bytecode"]
published_at: "2026-10-18T13:16:36+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T03:45:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112046", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# OW2 ASM: crafted class files hang the bytecode library, denying service

OW2 ASM 9.11 before 9.11.1 has an infinite loop in Label.resolve() when rewritten methods exceed 64 KB, because 16-bit forward-reference offsets truncate. An attacker who supplies crafted class files can hang ClassReader.accept() and deny service to build tools, instrumenters, agents or analyzers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ASM version in your build or dependency tree, for example `mvn dependency:tree | grep asm` or `gradle dependencies`
- Look for `org.ow2.asm:asm` at a version in `9.11` that is below `9.11.1`

## Fix

- Upgrade `org.ow2.asm` to `9.11.1` or later
- Rebuild and redeploy services or tools that bundle ASM, including shaded or fat jars

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112046

## From the sources

OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_