CVE-2026-112046

medium

Description

OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.

References

https://www.vulncheck.com/advisories/ow2-asm-9.11-before-9.11.1-denial-of-service-via-infinite-loop-in-label-resolve

https://gitlab.ow2.org/asm/asm/-/merge_requests/480

https://gitlab.ow2.org/asm/asm/-/commit/4bb1a4701e7b61c2163525b987a96a8db815cb68

https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_11/asm/src/main/java/org/objectweb/asm/Label.java#L417

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103508

https://asm.ow2.io/versions.html

Details

Source: Mitre, NVD

Published: 2026-10-18

Updated: 2026-10-18

Risk Information

CVSS v2

Base Score: 4.9

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

Severity: Medium

CVSS v3

Base Score: 5.5

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Severity: Medium

CVSS v4

Base Score: 6.8

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00119