Updated org.ow2.asm:*:9.11.1 to fix CVE-2026-112046.

doc/changes/changes_0.6.22.md

@@ -0,0 +1,36 @@
+# Udf Debugging Java 0.6.22, released 2026-10-20
+
+Code name: Fixed CVE-2026-112046
+
+## Summary
+
+This release fixes the following vulnerabilities by pinning the version of transitive dependencies `org.ow2.asm:*:9.11.1`.
+
+This is necessary because there is no update for `org.jacoco.agent` available yet that includes these updates.
+
+First pin was in version 0.6.21.
+
+* In `org.ow2.asm:asm:jar:9.10.1`:
+   * CVE-2026-110257: Uncontrolled Memory Allocation (6.8)
+   * CVE-2026-110258: Uncontrolled Memory Allocation (6.8)
+   * CVE-2026-110259: Uncontrolled Recursion (5.5)
+   * CVE-2026-110260: Algorithmic Complexity (5.5)
+   * CVE-2026-110261: Algorithmic Complexity (6.8)
+   * CVE-2026-110263: Uncontrolled Recursion (6.8)
+* In `org.ow2.asm:asm:jar:9.11`:
+  *  CVE-2026-112046: Loop with Unreachable Exit Condition ('Infinite Loop') (5.5)
+* In `org.ow2.asm:asm-commons:jar:9.10.1`
+   * CVE-2026-110262: Allocation of Resources Without Limits or Throttling (4.8)
+   * CVE-2026-110270: Algorithmic Complexity (5.5)
+
+## Features
+
+* Fixed CVEs in transitive dependency `org.ow2.asm:*` (PR# 91)
+
+## Dependency Updates
+
+### Compile Dependency Updates
+
+* Updated `org.ow2.asm:asm-commons:9.11` to `9.11.1`
+* Updated `org.ow2.asm:asm-tree:9.11` to `9.11.1`
+* Updated `org.ow2.asm:asm:9.11` to `9.11.1`

pom.xml

@@ -2,7 +2,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <artifactId>udf-debugging-java</artifactId>
-    <version>0.6.21</version>
+    <version>0.6.22</version>
     <name>udf-debugging-java</name>
     <description>Utilities for debugging, profiling and code coverage measure for UDFs.</description>
     <url>https://github.com/exasol/udf-debugging-java/</url>
@@ -37,22 +37,22 @@
         </dependency>
         <dependency>
             <!-- Pinned to fix CVE-2026-110257, CVE-2026-110258, CVE-2026-110259, CVE-2026-110260, CVE-2026-110261,
-             CVE-2026-110263 from 9.10.1-->
+             CVE-2026-110263 from 9.10.1 and CVE-2026-112046 from 9.11 (org.jacoco.agent) -->
             <groupId>org.ow2.asm</groupId>
             <artifactId>asm</artifactId>
-            <version>9.11</version>
+            <version>9.11.1</version>
         </dependency>
         <dependency>
-            <!-- Pinned to fix CVE-2026-110262, CVE-2026-110270 from 9.10.1-->
+            <!-- Pinned to fix CVE-2026-110262, CVE-2026-110270 from 9.10.1 (org.jacoco.agent) -->
             <groupId>org.ow2.asm</groupId>
             <artifactId>asm-commons</artifactId>
-            <version>9.11</version>
+            <version>9.11.1</version>
         </dependency>
         <dependency>
-            <!-- Pinned to stay in sync with the other asm dependencies -->
+            <!-- Pinned to stay in sync with the other asm dependencies (org.jacoco.agent) -->
             <groupId>org.ow2.asm</groupId>
             <artifactId>asm-tree</artifactId>
-            <version>9.11</version>
+            <version>9.11.1</version>
         </dependency>
         <dependency>
             <groupId>com.exasol</groupId>
@@ -164,7 +164,7 @@
     <parent>
         <artifactId>udf-debugging-java-generated-parent</artifactId>
         <groupId>com.exasol</groupId>
-        <version>0.6.21</version>
+        <version>0.6.22</version>
         <relativePath>pk_generated_parent.pom</relativePath>
     </parent>
 </project>