---
id: "CVE-2026-115892"
kind: "vulnerability"
aliases: ["CVE-2026-115892", "GHSA-9pvw-hwfg-92h5"]
title: "Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type"
severity: "medium"
cvss: 5.7
epss: 0.00564
exploited: false
status: "open"
category: "package"
products: [{"name": "wasmtime", "fixed": ["48.0.7"], "affected": ">= 46.0.0, < 48.0.7", "ecosystem": "cargo"}, {"name": "wasmtime", "fixed": ["49.0.4"], "affected": ">= 49.0.0, < 49.0.4", "ecosystem": "cargo"}]
ecosystems: ["cargo"]
tags: ["cargo", "cwe-843", "embedders", "package", "plugin-hosts", "rust", "wasmtime"]
not_affected_if: ["no-guest-round-trip", "static-typed-readers-only", "wasmtime-outside-affected-ranges"]
published_at: "2026-10-23T22:04:45+00:00"
first_seen_at: "2026-10-23T22:05:18+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-9pvw-hwfg-92h5", "first_seen_at": "2026-10-23T22:05:18+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115892", "first_seen_at": "2026-10-23T22:29:04+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115892", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type

A host application using Wasmtime can panic when it passes a component model stream or future it created to a guest with a different payload type than the one the host used. A malicious guest can trigger the mismatch, causing a denial of service in the host process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- cargo:wasmtime affected >= 46.0.0, < 48.0.7 fixed 48.0.7
- cargo:wasmtime affected >= 49.0.0, < 49.0.4 fixed 49.0.4

## How to check

- Look for `StreamReader::new` or `FutureReader::new` in host code, then check whether those streams or futures are passed through guest code and returned as `StreamAny`, `FutureAny`, `Val::Stream` or `Val::Future`.
- Check the Wasmtime version in Cargo.lock with `cargo tree -i wasmtime`; affected are `>= 46.0.0, < 48.0.7` and `>= 49.0.0, < 49.0.4`.

## Fix

- Upgrade the `wasmtime` crate to `48.0.7` on the 48.x line, or to `49.0.4` on the 49.x line.
- If upgrading is not possible, avoid passing host-created streams or futures through guests and back to guest functions with different payload types.

## Timeline

- 2026-10-23T22:05:18+00:00 ghsa https://github.com/advisories/GHSA-9pvw-hwfg-92h5
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115892
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115892

## From the sources

### Summary

Wasmtime may panic when the host lowers a component model `stream` or `future` into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives it back under a type-erased type such as `StreamAny` or `FutureAny`, and then passes it to a guest function with a different payload type.

GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory.

### Impact

This affects embedders that do all of the following:

1. Create streams or futures on the host with `StreamReader::new` or `FutureReader::new`
2. Pass them to guest code and receive them back as `StreamAny`, `FutureAny`, `Val::Stream`/`Val::Future`, or a typed reader whose payload is one of these.
3. Pass them on to a guest function whose `stream` or `future` payload type differs from the type the host created them with.

A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed `StreamReader<T>`/`FutureReader<T>` with concrete payload types throughout, or that never pass streams or futures they created through a guest and back, are not affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_