CVE-2026-115389: Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.20+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Bytecode Alliance Wasmtime with the dynamically typed Val API are exposed if they run a version before 36.0.16, versions 37.0.0 through before 48.0.3, or version 49.0.0 before 49.0.1.
What does an attacker need to exploit it?
An attacker needs to provide or control a malicious WebAssembly guest that can return crafted values through the dynamically typed Val API. Exploitation also requires a low-privileged context and user interaction, according to the supplied vector.
Why does the hostcall fuel limit not prevent the denial of service?
When guest values are lifted through the Val API, host allocations are inadequately accounted for. Crafted return values can therefore allocate at least about 100 times more host memory than is tracked, bypassing the hostcall fuel limit.
How can I determine whether I may be affected?
Check the Wasmtime version in use and whether the application lifts guest values through the dynamically typed Val API. Systems in the affected version ranges that execute untrusted or attacker-controlled WebAssembly guests should be prioritized for remediation.