Denial of Service Vulnerability in Wasmtime by Bytecode Alliance
CVE-2026-115380

5.1MEDIUM

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115380?

A denial of service vulnerability exists in Wasmtime, specifically in the wasmtime-wasi WASI preview 0 poll_oneoff adapter. This vulnerability allows malicious guest modules to submit excessive subscriptions that result in prolonged host computations, circumventing the configured fuel limits. Affected users should be aware of the potential for service disruption and take necessary measures to mitigate risks.

Affected Version(s)

wasmtime 0 < 36.0.17

wasmtime 37.0.0 < 48.0.4

wasmtime 49.0.0 < 49.0.2

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-before-36.0...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

smaeljaish771
KeenSecurityLab
.