Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 2

Vulnerabilities 1

• Medium 5.5
  CVE-2026-112046

  OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()

  OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 b…

  OW2 ASM asm asm Debian Ubuntu
  Oct 18, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-112046
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• article
  https://access.redhat.com/security/cve/CVE-2026-119078
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86201.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2554778
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-112046
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-112046
• article
  https://asm.ow2.io/versions.html
• article
  https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_11/asm/src/main/java/org/objectweb/asm/Label.java#L417
• article
  https://gitlab.ow2.org/asm/asm/-/commit/4bb1a4701e7b61c2163525b987a96a8db815cb68
• article
  https://gitlab.ow2.org/asm/asm/-/merge_requests/480
• article
  https://www.vulncheck.com/advisories/ow2-asm-9.11-before-9.11.1-denial-of-service-via-infinite-loop-in-label-resolve