CVE-2026-115390 Details
Description
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.
A denial-of-service vulnerability has been identified in Wasmtime versions 47.0.0 prior to 48.0.3 and 49.0.0 prior to 49.0.1. The issue arises from a flaw in fuel accounting within Cranelift-compiled call_ref and try_table catch paths. This vulnerability allows malicious guests to reset their consumed fuel after making certain calls, enabling them to run for an extended period on a linear fuel allowance. As a result, they can evade timeouts and periodic yields, causing a denial-of-service condition.
Users can upgrade to Wasmtime versions 48.0.3 or 49.0.1, both of which include patches for this vulnerability. Wasmtime embedders that only require periodic interruption may consider using epoch interruption as an alternative, although this method is not deterministic like fuel consumption metering.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | >= 47.0.0, < 48.0.3 (semver) >= 49.0.0, < 49.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |