OW2 ASM 9.11 libraries prior to version 9.11.1 contain an infinite loop in the Label.resolve() method. The loop occurs when 16‑bit forward‑reference offsets are truncated during method rewriting that causes the transformed bytecode to exceed 64 KB. When the loop is triggered, the ClassReader.accept() routine hangs, resulting in a denial of service that affects any build tools, instrumenters, agents or analyzers that rely on ASM to process class files. The weakness is classified as CWE‑835, an infinite loop flaw.

Vendors affected are OW2:ASM. All deployments that use ASM 9.11 or earlier, including any build utilities, code analysis frameworks, instrumentation tools or agents that embed the library, are susceptible. Versions prior to the 9.11.1 release are vulnerable; no additional product or version qualifiers are provided.

The CVSS base score of 6.8 indicates a moderate severity for denial of service. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers must provide a crafted class file that increases the rewritten method size beyond 65 535 bytes; therefore the likely attack vector is local or controlled input to a system that processes class files. While this limits remote exploitation, any compromised or malicious Java environment that uses ASM could be disrupted, leading to service outages or build failures.