CVE-2026-115380: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff

Q: Who is exposed to this denial-of-service condition?

Deployments using affected Wasmtime versions that execute untrusted or malicious guest modules and expose the wasmtime-wasi WASI Preview 0 poll_oneoff adapter are exposed. The issue is most relevant where fuel limits are relied upon to bound guest execution time.

Q: What does an attacker need to do to exploit it?

An attacker needs to provide or execute a malicious guest module that invokes poll_oneoff with many subscriptions. This causes O(n) host-side work that does not consume or check fuel.

Q: Are configured fuel limits sufficient mitigation on affected versions?

No. The affected poll_oneoff adapter can perform long-running host computation while bypassing configured fuel limits, so fuel limits alone do not prevent this denial of service.

Q: Which versions contain the fix?

The fixed releases are 36.0.17, 48.0.4, and 49.0.2. Affected ranges are versions before 36.0.17, 37.0.0 through before 48.0.4, and 49.0.0 through before 49.0.2.

Published Oct 22, 2026

Updated

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 polloneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.

Affected Software

1 affected component

Bytecode Alliance Wasmtime<36.0.17, >=37.0.0<48.0.4, >=49.0.0<49.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Wasmtime to a version that resolves this vulnerability.
Fixed in 49.0.2

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this denial-of-service condition?

Deployments using affected Wasmtime versions that execute untrusted or malicious guest modules and expose the wasmtime-wasi WASI Preview 0 poll_oneoff adapter are exposed. The issue is most relevant where fuel limits are relied upon to bound guest execution time.

What does an attacker need to do to exploit it?

An attacker needs to provide or execute a malicious guest module that invokes poll_oneoff with many subscriptions. This causes O(n) host-side work that does not consume or check fuel.

Are configured fuel limits sufficient mitigation on affected versions?

No. The affected poll_oneoff adapter can perform long-running host computation while bypassing configured fuel limits, so fuel limits alone do not prevent this denial of service.

Which versions contain the fix?

The fixed releases are 36.0.17, 48.0.4, and 49.0.2. Affected ranges are versions before 36.0.17, 37.0.0 through before 48.0.4, and 49.0.0 through before 49.0.2.

CVE-2026-115380: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service condition?

What does an attacker need to do to exploit it?

Are configured fuel limits sufficient mitigation on affected versions?

Which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service condition?

What does an attacker need to do to exploit it?

Are configured fuel limits sufficient mitigation on affected versions?

Which versions contain the fix?