{"id":"CVE-2026-115892","kind":"vulnerability","aliases":["CVE-2026-115892","GHSA-9pvw-hwfg-92h5"],"related":[],"title":"Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type","description":"### Summary\n\nWasmtime may panic when the host lowers a component model `stream` or `future` into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives it back under a type-erased type such as `StreamAny` or `FutureAny`, and then passes it to a guest function with a different payload type.\n\nGHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory.\n\n### Impact\n\nThis affects embedders that do all of the following:\n\n1. Create streams or futures on the host with `StreamReader::new` or `FutureReader::new`\n2. Pass them to guest code and receive them back as `StreamAny`, `FutureAny`, `Val::Stream`/`Val::Future`, or a typed reader whose payload is one of these.\n3. Pass them on to a guest function whose `stream` or `future` payload type differs from the type the host created them with.\n\nA guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed `StreamReader<T>`/`FutureReader<T>` with concrete payload types throughout, or that never pass streams or futures they created through a guest and back, are not affected.","summary":"A host application using Wasmtime can panic when it passes a component model stream or future it created to a guest with a different payload type than the one the host used. A malicious guest can trigger the mismatch, causing a denial of service in the host process.","severity":"medium","cvss":5.7,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[{"name":"wasmtime","fixed":["48.0.7"],"affected":">= 46.0.0, < 48.0.7","ecosystem":"cargo"},{"name":"wasmtime","fixed":["49.0.4"],"affected":">= 49.0.0, < 49.0.4","ecosystem":"cargo"}],"ecosystems":["cargo"],"tags":["cargo","cwe-843","embedders","package","plugin-hosts","rust","wasmtime"],"not_affected_if":["no-guest-round-trip","static-typed-readers-only","wasmtime-outside-affected-ranges"],"how_to_check":"- Look for `StreamReader::new` or `FutureReader::new` in host code, then check whether those streams or futures are passed through guest code and returned as `StreamAny`, `FutureAny`, `Val::Stream` or `Val::Future`.\n- Check the Wasmtime version in Cargo.lock with `cargo tree -i wasmtime`; affected are `>= 46.0.0, < 48.0.7` and `>= 49.0.0, < 49.0.4`.","fix":"- Upgrade the `wasmtime` crate to `48.0.7` on the 48.x line, or to `49.0.4` on the 49.x line.\n- If upgrading is not possible, avoid passing host-created streams or futures through guests and back to guest functions with different payload types.","status":"open","published_at":"2026-10-23T22:04:45+00:00","first_seen_at":"2026-10-23T22:05:18+00:00","triaged_at":"2026-10-25T04:10:24+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:10:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `wasmtime` crate to `48.0.7` on the 48.x line, or to `49.0.4` on the 49.x line.\n- If upgrading is not possible, avoid passing host-created streams or futures through guests and back to guest functions with different payload types.","reach":"unknown","title":"Wasmtime: host-created component stream type mismatch makes the host panic","impact":"low","summary":"A host application using Wasmtime can panic when it passes a component model stream or future it created to a guest with a different payload type than the one the host used. A malicious guest can trigger the mismatch, causing a denial of service in the host process.","category":"package","nicknames":[],"who_cares":["wasmtime","rust","cargo","embedders","plugin-hosts"],"confidence":0.8,"needs_auth":"unknown","worst_case":"A malicious guest crashes the host process with a panic","analyst_note":"","how_to_check":"- Look for `StreamReader::new` or `FutureReader::new` in host code, then check whether those streams or futures are passed through guest code and returned as `StreamAny`, `FutureAny`, `Val::Stream` or `Val::Future`.\n- Check the Wasmtime version in Cargo.lock with `cargo tree -i wasmtime`; affected are `>= 46.0.0, < 48.0.7` and `>= 49.0.0, < 49.0.4`.","needs_analyst":false,"not_affected_if":["static-typed-readers-only","no-guest-round-trip","wasmtime-outside-affected-ranges"],"who_is_affected":"Only embedders that create streams or futures on the host, send them to guest code, receive them back under a type-erased type, and pass them to a guest function with a different payload type are exposed. Hosts that use only statically typed readers with concrete payload types throughout, or that never round-trip their own streams or futures through a guest, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000724,"input_tokens":3824,"output_tokens":684,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115892':22A,30A '-2026':21A,29A '-843':35B '1':214C '2':228C '3':255C,286C '63h4':172C '6cx9':173C '92h5':27A '9pvw':25A 'advisori':178C,187C,203C 'affect':206C,347C 'also':179C 'applic':45B 'area':184C 'back':145C,237C,344C 'cargo':33B 'case':305C 'caus':82B,281C 'code':233C 'compon':8A,54B,100C 'concret':327C 'control':289C 'creat':7A,60B,111C,133C,215C,275C,339C 'cve':20A,28A 'cwe':34B 'denial':84B,315C 'differ':17A,66B,125C,167C,269C 'embedd':36B,132C,207C,318C 'eras':150C 'expect':15A,123C 'export':296C 'fix':180C,198C 'follow':213C 'function':164C,262C,294C 'futur':58B,104C,115C,137C,218C,244C,266C,337C 'futureani':156C,240C 'futureread':226C,325C 'ghsa':24A,171C 'ghsa-63h4-6cx9-pjfj':170C 'ghsa-9pvw-hwfg-92h5':23A 'guest':13A,63B,77B,107C,122C,142C,163C,232C,261C,279C,308C,342C 'happen':129C 'host':6A,40B,44B,73B,89B,97C,110C,221C,274C,312C 'host-creat':5A 'hwfg':26A 'impact':204C 'issu':181C,190C 'lower':3A,98C 'make':310C 'malici':76B,307C 'may':93C 'mismatch':81B,283C 'model':9A,55B,101C 'never':333C 'new':224C,227C 'one':71B,117C,126C,252C 'packag':37B 'panic':2A,49B,94C,313C 'part':200C 'pass':52B,138C,159C,229C,256C,334C 'payload':18A,67B,118C,168C,250C,267C,328C 'pjfj':174C 'plugin':39B 'plugin-host':38B 'portion':192C 'process':90B 'reader':248C 'receiv':143C,235C 'relat':177C 'return':302C 'rust':41B 'servic':86B,317C 'static':322C 'step':285C 'stream':10A,56B,102C,113C,135C,216C,242C,264C,335C 'streamani':154C,239C 'streamread':223C,324C 'summari':91C 'throughout':330C 'trigger':79B 'type':19A,68B,119C,149C,151C,169C,247C,268C,272C,291C,323C,329C 'type-eras':148C 'use':46B,74B,321C 'val':241C,243C 'valu':300C 'wasmtim':1A,42B,47B,92C,194C 'wasmtime':31A,32A 'whose':249C,263C 'within':182C","nicknames":[],"mitigations":[],"who_affected":"Only embedders that create streams or futures on the host, send them to guest code, receive them back under a type-erased type, and pass them to a guest function with a different payload type are exposed. Hosts that use only statically typed readers with concrete payload types throughout, or that never round-trip their own streams or futures through a guest, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T22:04:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9pvw-hwfg-92h5","url":"https://github.com/advisories/GHSA-9pvw-hwfg-92h5","severity":"medium","published_at":"2026-10-23T22:04:45+00:00","modified_at":"2026-10-23T22:04:47+00:00","first_seen_at":"2026-10-23T22:05:18+00:00","fetched_at":"2026-10-23T22:15:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-115892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115892","severity":null,"published_at":"2026-10-23T22:16:58+00:00","modified_at":"2026-10-23T22:16:58+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115892","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115892","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}