Live › vulnerability › CVE-2026-119138
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 let pending calls hit an assertion failure after a trap poisons the Store. Attackers who supply misbehaving guest code can crash embedders that keep using the inconsistent Store, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Applications that embed Wasmtime to run untrusted WebAssembly guest code and keep using a Store after a trap. Services that only run trusted modules or never reuse a Store after a trap are less exposed. unknown whether other configurations are affected.
No product ranges from the sources yet.
wasmtime --version or the wasmtime entry in Cargo.lock48.0.6 for the 46/48 line49.0.3 for the 49 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store.
This page as .md · .json · in your agent: get_signal("CVE-2026-119138")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.