Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2026-119142: Wasmtime may crash when async call is cancelled
CVE-2026-119142 · published 6 days ago
Summary
The Wasmtime runtime (versions before 48.0.6 and 49.0.3) can stop working if an asynchronous function call is abandoned before it starts. This can cause the host application that uses Wasmtime to crash, potentially disrupting services. Upgrade Wasmtime to version 48.0.6 or later (or 49.0.3 or later) to prevent the crash.
What to do
- Update bytecodealliance wasmtime to version 48.0.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| bytecodealliance | wasmtime | < 48.0.6 |
Original advisory text
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-617Reachable Assertion
Timeline
Published29 Oct 2026
Updated30 Oct 2026
First seen29 Oct 2026
Track software like this
Free during beta