Skip to content
fr Sign in
1.0 Low

CVE-2026-115389 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations…

Description

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.

Affected products and versions

Product Affected versions Fixed in
wasmtime 49.0 49.0.0 → < 49.0.1 49.0.1
wasmtime 48.0 earliest → < 48.0.3 48.0.3
wasmtime 37.0 37.0.0 → < 48.0.3 48.0.3
wasmtime 36.0 earliest → < 36.0.16 36.0.16

References

Timeline

  1. Published
  2. Last modified

Other CVEs of wasmtime

The 81 CVEs of wasmtime →
CVE-2026-121441 Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in… 6.3 Medium CVE-2026-121440 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the… 6.3 Medium CVE-2026-121439 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3… 6.9 Medium CVE-2026-119143 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes 5.9 Medium
Track this CVE