CVE-2026-115380: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 polloneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.20+dfsg-1 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.17 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 48.0.4 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 49.0.2
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service condition?
Deployments using affected Wasmtime versions that execute untrusted or malicious guest modules and expose the wasmtime-wasi WASI Preview 0 poll_oneoff adapter are exposed. The issue is most relevant where fuel limits are relied upon to bound guest execution time.
What does an attacker need to do to exploit it?
An attacker needs to provide or execute a malicious guest module that invokes poll_oneoff with many subscriptions. This causes O(n) host-side work that does not consume or check fuel.
Are configured fuel limits sufficient mitigation on affected versions?
No. The affected poll_oneoff adapter can perform long-running host computation while bypassing configured fuel limits, so fuel limits alone do not prevent this denial of service.
Which versions contain the fix?
The fixed releases are 36.0.17, 48.0.4, and 49.0.2. Affected ranges are versions before 36.0.17, 37.0.0 through before 48.0.4, and 49.0.0 through before 49.0.2.