Fuel Accounting Flaw in Wasmtime Affects Recent Versions
CVE-2026-115390

6.9MEDIUM

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115390?

Wasmtime versions prior to 48.0.3 and 49.0.1 are susceptible to a fuel accounting flaw that allows malicious actors to exploit the Cranelift-compiled call_ref and try_table mechanisms. This vulnerability enables attackers to manipulate the fuel consumption metric, allowing them to run processes for an indefinite period without being interrupted by timeouts or yielding periods. Consequently, this may lead to denial of service by excessively exhausting system resources.

Affected Version(s)

wasmtime 47.0.0 < 48.0.3

wasmtime 49.0.0 < 49.0.1

wasmtime 48.0.3

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-47.0.0-befo...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

fitzgen
.