CVE-2026-112046— OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
Quick assessment
Affected
OW2 ASM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OW2 ASM 9.11（9.11.1 之前版本）的 方法中存在一个无限循环漏洞。该漏洞由 16 位前向引用偏移量在重写方法超过 64 KB 时发生截断所引发。攻击者可提供精心构造的类文件，使其变换后的代码长度超过 65535 字节，从而导致 陷入挂起状态，使构建工具、插桩器、Agent 或分析器无法提供服务。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112046
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
Source: CVE Program / CVE List V5
Vulnerability Description
OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-112046
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112046
请登录查看更多情报信息。
Other References for CVE-2026-112046 (2)
IV. Related Vulnerabilities
Same product: ASM
-
CVE-2026-110591
OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via -
CVE-2026-110270
OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSR -
CVE-2026-110263
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureR -
CVE-2026-110262
OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in Advic -
CVE-2026-110261
OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassW
Same vendor: OW2
-
CVE-2026-110591
OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via -
CVE-2026-110270
OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSR -
CVE-2026-110263
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureR -
CVE-2026-110262
OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in Advic -
CVE-2026-110261
OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassW
Same weakness: CWE-835
-
CVE-2026-105273
J4Care dcm4che Loop with Unreachable Exit Condition -
CVE-2026-107621
J4Care dcm4che Loop with Unreachable Exit Condition -
CVE-2026-97370
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU l -
CVE-2026-104266
tinytag: Infinite loop when parsing certain M4A files contai -
CVE-2026-110836
FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Co
V. Comments for CVE-2026-112046
No comments yet