CVE-2026-115382: Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-wasmtimeto a version that resolves this vulnerability.Fixed in 26.0.1+dfsg-3Fixed in 36.0.13+dfsg-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Hosts embedding affected Wasmtime versions and enabling or using the wasi:http implementation are exposed when they run guests that can set request options. The impact is denial of service through a host crash.
What must an attacker control to trigger the crash?
An attacker needs the ability to run or influence a Wasmtime guest that can issue a wasi:http request with the between-bytes-timeout option set to zero. That zero value is forwarded to a Tokio API that panics.
Which versions are affected and which releases contain fixes?
The affected ranges are Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2. Updating to 48.0.4 or 49.0.2, as applicable to the release line in use, addresses the issue.