Denial of Service Vulnerability in Wasmtime by Bytecode Alliance
CVE-2026-119140

5.9MEDIUM

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119140?

A denial of service vulnerability exists in Wasmtime versions 46.0.0 to 49.0.3, where a malicious component can exploit the thread.yield function in start functions. This can lead to an unmanaged fiber drop and crash the host environment, causing service disruption for applications relying on Wasmtime.

Affected Version(s)

wasmtime 46.0.0 < 48.0.6

wasmtime 49.0.0 < 49.0.3

wasmtime 48.0.6

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-46.0.0-befo...
third-party-advisory

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

tschneidereit
.