Denial of Service in Wasmtime by Bytecode Alliance
CVE-2026-115389

1LOW

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115389?

The wasmtime vulnerability allows a malicious WebAssembly guest to exploit the Val API by returning crafted values that allocate significantly more host memory than expected. This effectively bypasses the hostcall fuel limit, potentially leading to serious performance issues and service disruptions. Affected versions prior to specified updates do not adequately manage host allocations, making systems vulnerable to targeted denial of service attacks.

Affected Version(s)

wasmtime 0 < 36.0.16

wasmtime 37.0.0 < 48.0.3

wasmtime 49.0.0 < 49.0.1

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-before-36.0...
third-party-advisory

CVSS V4

Score:
1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wilfreddenton
.