CVE-2026-112046 OW2 CVE debrief

Who should care

Defenders responsible for build tools, instrumenters, agents, or analyzers using OW2 ASM 9.11 before 9.11.1 should verify and update to version 9.11.1 or later to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-112046 is a vulnerability in OW2 ASM 9.11 before 9.11.1 that can cause a denial of service to build tools, instrumenters, agents, or analyzers. Defenders should prioritize verifying and updating OW2 ASM to version 9.11.1 or later to prevent potential denial-of-service attacks.

• Denial of service to build tools, instrumenters, agents, or analyzers
• Potential disruption to development and analysis workflows
• Need for verification and updating of OW2 ASM to version 9.11.1 or later

Technical summary

The vulnerability is caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB, leading to an infinite loop in Label.resolve(). This issue can cause a denial of service to build tools, instrumenters, agents, or analyzers. Defenders should prioritize verifying and updating OW2 ASM to version 9.11.1 or later to prevent potential denial-of-service attacks. The vulnerability affects OW2 ASM 9.11 before 9.11.1 and can be triggered by crafted class files whose transformed code grows past 65535 bytes.

Defensive priority

Defenders should prioritize verifying and updating OW2 ASM to version 9.11.1 or later to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify OW2 ASM version and update to 9.11.1 or later if necessary
• Review and monitor build tools, instrumenters, agents, or analyzers for potential denial-of-service attacks
• Implement compensating controls to mitigate potential impacts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB, leading to an infinite loop in Label.resolve(). Evidence is limited to public CVE and NVD records. Defenders should verify OW2 ASM versions and review build tools, instrumenters, agents, or analyzers for potential denial-of-service attacks. No additional evidence is available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.