Live › vulnerability › CVE-2026-115380
Go to dashboardWasmtime's WASI preview 0 poll_oneoff adapter does linear host work per subscription without charging fuel. A malicious guest module can pass many subscriptions and force long host computation that ignores configured fuel limits.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that embed Wasmtime with wasmtime-wasi and run guest WebAssembly modules that a party outside the team controls, such as plugin systems or multi-tenant function runners. Hosts that run only trusted modules, or that do not use the WASI preview 0 poll_oneoff path, are less exposed.
No product ranges from the sources yet.
wasmtime --version, and compare it to the fixed releases.36.0.17 on the 36 line, 48.0.4 on the 48 line, or 49.0.2 on the 49 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.
This page as .md · .json · in your agent: get_signal("CVE-2026-115380")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.