Live › vulnerability › CVE-2026-119134
Wasmtime, the WebAssembly runtime, does not count component-model resource handles against the store's memory limits, so a malicious guest can repeatedly create resources and sub-components. This makes host memory grow without bound, which can crash the host process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams that embed Wasmtime to run WebAssembly components supplied by untrusted users or third parties are exposed, because a guest can drive host memory use upward. Applications running only trusted, first-party WebAssembly, or not using the component model, are less exposed. unknown whether the sources list any further configuration conditions.
No product ranges from the sources yet.
Unknown from the sources.
36.0.1848.0.649.0.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.
This page as .md · .json · in your agent: get_signal("CVE-2026-119134")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.