Live › vulnerability › CVE-2026-119137
Wasmtime versions 42.0.0 through 48.0.5 and 49.0.0 through 49.0.2 can be made to overflow the host stack when a guest defines a long chain of recursive types and that top-level type is removed. An attacker running untrusted WebAssembly guest code can crash the host process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Only systems that load and run untrusted WebAssembly guests with Wasmtime 42.x or 49.x (before the fixed versions) are exposed; a guest can crash the host through recursive type drops. Teams running only trusted modules or not using Wasmtime can skip it.
No product ranges from the sources yet.
wasmtime --version (or check the Wasmtime crate version in Cargo.lock) and compare against the affected ranges 42.0.0 to before 48.0.6 and 49.0.0 to before 49.0.3.48.0.6 for the 48.x line49.0.3 for the 49.x lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack.
This page as .md · .json · in your agent: get_signal("CVE-2026-119137")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.