CVE-2026-112046

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112046
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112046.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112046
Downstream
Published
2026-10-18T12:19:35Z
Modified
2026-10-22T02:49:08Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
Details

OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-835"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112046.json"
}
References

Affected packages

Git / gitlab.ow2.org/asm/asm

Affected ranges

Type
GIT
Repo
https://gitlab.ow2.org/asm/asm
Events
Introduced
baeba2ca4e5f8196795340b015ca8b69f39740f5
Fixed
e1f096ce6e9f6de64921ea8b437676f146798185
Fixed
4bb1a4701e7b61c2163525b987a96a8db815cb68
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "9.11"
                },
                {
                    "fixed":  "9.11.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "4bb1a4701e7b61c2163525b987a96a8db815cb68"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
ASM_9_11

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112046.json"