CVE-2026-115389
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
wasmtime
- Vendor
- bytecodealliance
- Product
- wasmtime
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | 36.0.16 | Unavailable | None listed |
| 36.0.16 | unaffected | semver | Unavailable | Unavailable | None listed |
| 37.0.0 | affected | semver | 48.0.3 | Unavailable | None listed |
| 48.0.3 | unaffected | semver | Unavailable | Unavailable | None listed |
| 49.0.0 | affected | semver | 49.0.1 | Unavailable | None listed |
| 49.0.1 | unaffected | semver | Unavailable | Unavailable | None listed |