CVE-2026-115382: Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS

Q: Who is exposed to this issue?

Hosts embedding affected Wasmtime versions and enabling or using the wasi:http implementation are exposed when they run guests that can set request options. The impact is denial of service through a host crash.

Q: What must an attacker control to trigger the crash?

An attacker needs the ability to run or influence a Wasmtime guest that can issue a wasi:http request with the between-bytes-timeout option set to zero. That zero value is forwarded to a Tokio API that panics.

Q: Which versions are affected and which releases contain fixes?

The affected ranges are Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2. Updating to 48.0.4 or 49.0.2, as applicable to the release line in use, addresses the issue.

Published Oct 22, 2026

Updated

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.

Affected Software

1 affected component

Bytecode Alliance Wasmtime>=46.0.0<48.0.4, >=49.0.0<49.0.2

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Hosts embedding affected Wasmtime versions and enabling or using the wasi:http implementation are exposed when they run guests that can set request options. The impact is denial of service through a host crash.

What must an attacker control to trigger the crash?

An attacker needs the ability to run or influence a Wasmtime guest that can issue a wasi:http request with the between-bytes-timeout option set to zero. That zero value is forwarded to a Tokio API that panics.

Which versions are affected and which releases contain fixes?

The affected ranges are Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2. Updating to 48.0.4 or 49.0.2, as applicable to the release line in use, addresses the issue.

CVE-2026-115382: Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker control to trigger the crash?

Which versions are affected and which releases contain fixes?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker control to trigger the crash?

Which versions are affected and which releases contain fixes?