CVE-2026-126407 · Runtime
NO FIX YET · SEE WHAT TO DO
Wasmtime allocates host memory for borrowed resources without counting them against the per-store handle limit. A malicious guest component can repeat these transfers to consume arbitrary host memory and cause a denial of service.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that embed Wasmtime and run untrusted WebAssembly component guests are exposed, because a guest can trigger the unbounded host allocation. Systems that run only trusted components or do not use the component model with resource borrows can skip it.
Not affected if no-component-model, trusted-guests-only
Who cares self-hosted, wasmtime, webassembly
wasmtime --version or the crate version in Cargo.lock.36.0.2048.0.849.0.550.0.1Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component can repeatedly transfer such borrowed resources to consume arbitrary host memory, causing denial of service.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.