5.9
Medium
CVE-2026-44216 Wasmtime is a runtime for WebAssembly
Description
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| wasmtime | 44.0.0 | No fix stated |
| wasmtime 37.0 | 37.0.0 → < 43.0.2 | 43.0.2 |
| wasmtime 30.0 | 30.0.0 → < 36.0.8 | 36.0.8 |
| Red Hat Hardened Images 1.97 | earliest → < 1.97.1-2.hum1 | 1.97.1-2.hum1 |
| Red Hat Enterprise Linux 10 | Versions not published |
Other CVEs of wasmtime
The 81 CVEs of wasmtime →
CVE-2026-121441
Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in…
6.3
Medium
CVE-2026-121440
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the…
6.3
Medium
CVE-2026-121439
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3…
6.9
Medium
CVE-2026-119143
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
5.9
Medium