Live › vulnerability › CVE-2026-115389
Go to dashboardWasmtime's dynamically-typed Val API does not count host memory allocated while lifting guest return values, so it bypasses the hostcall fuel limit. A malicious WebAssembly guest can make the host allocate about 100 times more memory than tracked, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only applications that embed Wasmtime and run untrusted WebAssembly guests that return values through the dynamically-typed Val API are exposed. Hosts that run only trusted guest code, or that use the typed API, are less likely to be affected; the sources do not say more.
No product ranges from the sources yet.
wasmtime --version on the host or check the pinned wasmtime crate version in Cargo.lockVal API when running untrusted guest modules36.0.16 on the 36.x line, 48.0.3 on the 48.x line (37.0.0 and later within that range), or 49.0.1 on the 49.x lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-115389")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.