CVE-2026-119134 Details

A vulnerability in Wasmtime versions prior to 36.0.18, 37.0.0 prior to 48.0.6, and 49.0.0 prior to 49.0.3 allows for unbounded host memory growth. This issue arises because component-model resource handle tables are capped only per component instance and do not account for handle allocations in any ResourceLimiter or StoreLimits. As a result, a malicious guest can repeatedly call resource.new and instantiate sub-components, exceeding the per-instance cap and causing excessive memory usage on the host.

Users can upgrade to Wasmtime versions 49.0.3, 48.0.6, or 36.0.18, all of which include the necessary fix. The new default limit is set to 100,000 live handles per store, which approximately equates to 2.4 MB of handle-table memory. Embedders can adjust this limit using the Store::set_max_component_handles(n) function or via the -S max-component-handles=N command-line flag when using Wasmtime.