Description
OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OW2 | ASM | 9.11 – < 9.11.1 | 9.11.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asm | 9.11.1-1 | — |
| Debian 13 | asm | No fix yet | — |
| Debian 12 | asm | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | asm | No fix yet | — |
| Ubuntu 26.04 LTS | asm | No fix yet | — |
| Ubuntu 24.04 LTS | asm | No fix yet | — |
| Ubuntu 22.04 LTS | asm | No fix yet | — |
| Ubuntu 20.04 LTS | asm | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | asm | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | maven3.9 +1 | 3.9.16-0.5.hum1 | RHSA-2026:86201 |
Advisories 1
- RHSA-2026:86201 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
References
- https://gitlab.ow2.org/asm/asm/-/merge_requests/480 patch
- https://gitlab.ow2.org/asm/asm/-/commit/4bb1a4701e7b61c2163525b987a96a8db815cb68 patch
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_11/asm/src/main/java/org/objectweb/asm/Label.java#L417 technical-description
- ASM 9.11.1 Release Notes release-notes
- VulnCheck Advisory: OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve() third-party-advisory