Live › vulnerability › CVE-2026-119142
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panic when the Future returned by TypedFunc::call_async is dropped before the guest task starts. An attacker who can make an embedder cancel pending calls crashes the host process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Applications that embed Wasmtime and call async typed functions, where cancelling a pending call (through a timeout, disconnect or task abort) can crash the host. Standalone CLI use that never drops async calls mid-flight is less exposed. Versions outside the two affected ranges are not affected.
No product ranges from the sources yet.
cargo tree -i wasmtime in a Rust project.TypedFunc::call_async and may drop or cancel those futures, such as timeouts or client disconnects.48.0.6 or later on the 48 line.49.0.3 or later on the 49 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls.
This page as .md · .json · in your agent: get_signal("CVE-2026-119142")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.