Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
1.0

Wasmtime can be forced into excessive memory use

CVE-2026-115389 · published 13 days ago
Summary

Versions of Wasmtime before the latest releases may let a specially crafted WebAssembly program cause the host system to allocate far more memory than expected, potentially leading to a service slowdown or crash. This happens because the runtime does not correctly track memory usage when handling values coming from the guest code. Updating Wasmtime to the newest version resolves the problem; if you cannot upgrade immediately, limit or isolate untrusted WebAssembly workloads.

What to do
  • Update bytecodealliance wasmtime to version 36.0.16 or later.
Affected software
VendorProductAffected versions
bytecodealliance wasmtime < 36.0.16
Original advisory text
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
1.0 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published22 Oct 2026
Updated29 Oct 2026
First seen22 Oct 2026
Sources
CVE-2026-115389 · NVD
CVE-2026-115389 · MITRE
Track software like this
Free during beta