Infinite Loop Vulnerability in OW2 ASM 9.11 by OW2
CVE-2026-112046

6.8MEDIUM

Key Information:

Vendor

Ow2

Status
Asm
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112046?

The OW2 ASM 9.11 software before version 9.11.1 is susceptible to an infinite loop vulnerability affecting the Label.resolve() method. This issue occurs when 16-bit forward-reference offsets truncate during the execution of rewritten methods that exceed 64 KB in size. Malicious actors can exploit this vulnerability by submitting specially crafted class files, resulting in a Denial of Service (DoS). This attack can lead to significant interruptions for build tools, instrumentation agents, or code analyzers, effectively hanging the ClassReader.accept() process.

Affected Version(s)

ASM 9.11 < 9.11.1

References

https://gitlab.ow2.org/asm/asm/-/merge_requests/480
patch
https://gitlab.ow2.org/asm/asm/-/commit/4bb1a4701e7b61c21...
patch
https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_11/asm/src/ma...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric Bruneton
.