Live › vulnerability › CVE-2026-115390
Go to dashboardWasmtime versions 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 miscount consumed fuel in Cranelift-compiled call_ref and try_table catch paths. A malicious WebAssembly guest can reset its fuel after calls and run far longer than its limit, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that embed Wasmtime and run untrusted WebAssembly guest modules, such as plugin systems or multi-tenant function runtimes, depend on fuel and timeouts to bound guest work. Hosts that only run their own trusted Wasm code or do not use Wasmtime can skip it.
No product ranges from the sources yet.
wasmtime --version48.0.3 on the 48 line or 49.0.1 on the 49 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-115390")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.