CVE-2026-119137 Details
Description
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack.
A stack overflow vulnerability has been identified in Wasmtime versions 42.0.0 prior to 48.0.6, as well as in versions 49.0.0 prior to 49.0.3. This vulnerability allows guests to crash the host by exploiting recursive type drops. Guests can create a lengthy chain of recursive types, and when the top-level type is removed, it triggers unbounded recursive drops that can exhaust the host's stack. The issue arises from a recursion flaw introduced in Wasmtime 42.0.0, which reversed a previous safeguard that converted recursive type drops into an iterative process.
Users can upgrade to Wasmtime versions 48.0.6 or 49.0.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | >= 42.0.0, < 48.0.6 (semver) >= 49.0.0, < 49.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |