Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck
CVE-2026-115389Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API
Low 2.3
In plain English
A low-severity resource allocation without limits in wasmtime from bytecodealliance. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | rust-wasmtime | no fix listed | DEBIAN-CVE-2026-115389 |
| Debian:14 | rust-wasmtime | 36.0.20+dfsg-1 | DEBIAN-CVE-2026-115389 |
| Ubuntu:24.04:LTS | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-115389 |
| Ubuntu:26.04:LTS | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-115389 |
| Ubuntu:26.10 | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-115389 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bytecodealliance | wasmtime | 0 – before 36.0.1637.0.0 – before 48.0.349.0.0 – before 49.0.1 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L