Vulnerability · Published Oct 29, 2026 · Assigned by VulnCheck
CVE-2026-119134Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles
Medium 6.2
In plain English
A medium-severity resource allocation without limits in wasmtime from bytecodealliance. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | rust-wasmtime | no fix listed | DEBIAN-CVE-2026-119134 |
| Debian:14 | rust-wasmtime | 36.0.20+dfsg-1 | DEBIAN-CVE-2026-119134 |
| Ubuntu:24.04:LTS | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-119134 |
| Ubuntu:26.04:LTS | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-119134 |
| Ubuntu:26.10 | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-119134 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bytecodealliance | wasmtime | 0 – before 36.0.1837.0.0 – before 48.0.649.0.0 – before 49.0.3 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H