CVE-2026-115389 Details
Description
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.
A denial-of-service vulnerability has been identified in Wasmtime versions prior to 36.0.16, 37.0.0 prior to 48.0.3, and 49.0.0 prior to 49.0.1. The issue arises because the Val API does not properly manage host memory allocations when transferring values from a WebAssembly guest, allowing malicious guests to allocate significantly more memory on the host than is monitored. This oversight can lead to a denial-of-service condition by exhausting available host resources.
Users are advised to upgrade to Wasmtime versions 36.0.16, 48.0.3, or 49.0.1, all of which have been patched for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | <= 36.0.15 (semver) >= 37.0.0, < 48.0.3 (semver) >= 49.0.0, < 49.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |