Live › vulnerability › CVE-2026-119135
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panic when the host reads a component model stream as a different Rust type than it was created with. Guest code can trigger this by returning a host-created stream that the embedder reads with a mismatched type, crashing the embedding process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Only applications that embed Wasmtime and read component model streams from the host, where guest code can return a host-created stream. Standalone CLI use and embedders that do not use streams with mismatched types are less exposed. The crash is a denial of service in the embedding process rather than code execution, as far as the sources state.
No product ranges from the sources yet.
Unknown from the sources.
48.0.6 or later49.0.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created StreamReader<U> that the embedder reads as StreamReader<T>, where both types map to the same component model type, crashing the embedding process.
This page as .md · .json · in your agent: get_signal("CVE-2026-119135")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.