CVE-2026-112046: OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OW2 ASMto a version that resolves this vulnerability.Fixed in 9.11.1
Event History
Frequently Asked Questions
Which environments are realistically exposed to this issue?
Build tools, bytecode instrumenters, agents, and analyzers that use affected OW2 ASM versions and process attacker-supplied or otherwise untrusted class files are exposed. The impact is a hang in ClassReader.accept(), which can deny service to the processing workflow.
What must an attacker provide to trigger the denial of service?
An attacker must supply a crafted class file that, when transformed, causes method code to grow beyond 65,535 bytes. The condition leads to truncation of 16-bit forward-reference offsets and an infinite loop in Label.resolve().
Are default deployments affected?
The provided information does not identify a default configuration requirement. Exploitation depends on an affected ASM version processing a crafted class file through a transformation path that expands a method past 64 KB.
What can be done if an immediate upgrade is not possible?
Avoid processing untrusted class files with affected ASM-based transformation workflows, particularly where transformations may substantially increase method size. Restricting or isolating such processing can reduce the availability impact until upgrading to 9.11.1 or later.