CVE-2026-112046: ASM 9.11 to before 9.11.1

Affected technology

ASM · 9.11 to before 9.11.1
OW2

Description’s affected range: before 9.11.1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers. Vendor/CNA’s CVSS 4.0 assessment (base score 6.8/10) rates confidentiality and integrity impact as none; availability impact as high.