CVE-2026-115382 Details
Description
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.
A denial-of-service vulnerability has been identified in Wasmtime versions 46.0.0 prior to 48.0.4 and 49.0.0 prior to 49.0.2. The issue arises in the wasi:http implementation, where guests can specify a zero between-bytes-timeout request option. This zero timeout is forwarded directly to a Tokio API, which panics and crashes the host embedding. The vulnerability allows guests to intentionally cause a panic on the host, leading to a denial-of-service condition.
Users are advised to upgrade to Wasmtime versions 48.0.4 or 49.0.2, which fix the issue by clamping the timeout duration to 1 nanosecond. For those using an embedding that does not provide wasi:http APIs, no action is needed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | >= 46.0.0, < 48.0.4 (semver) >= 49.0.0, < 49.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |